Cpython (Python Software Foundation) - vulnerabilities (CVEs)

77 CVEs, 6 in the last 30 days, 2 known versions, newest CVE from 2026-10-27. Vendor: Python Software Foundation.

CVEs of Cpython

• CVE-2026-103995 - CVSS 2 (low), 2026-10-27: Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.
• CVE-2026-115557 - CVSS 9.4 (critical), 2026-10-24: Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known…
• CVE-2026-114583 - CVSS 6.9 (medium), 2026-10-22: tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members…
• CVE-2026-19553 - CVSS 7.6 (high), 2026-09-30: ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter…
• CVE-2026-19445 - CVSS 9.2 (critical), 2026-09-30: A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to…
• CVE-2026-12345 - CVSS 5.9 (medium), 2026-09-29: The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with…
• CVE-2026-82049 - CVSS 8.4 (high), 2026-09-14: In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic…
• CVE-2026-87910 - CVSS 5.7 (medium), 2026-09-11: When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function…
• CVE-2026-15310 - CVSS 2.1 (low), 2026-08-25: When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly…
• CVE-2026-19672 - CVSS 6.3 (medium), 2026-08-19: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to…
• CVE-2026-15806 - CVSS 6 (medium), 2026-08-18: The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not…
• CVE-2026-17084 - CVSS 6 (medium), 2026-08-18: The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the…
• CVE-2026-18503 - CVSS 2.4 (low), 2026-08-10: Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass…
• CVE-2026-6879 - CVSS 2 (low), 2026-07-28: `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`,…
• CVE-2026-15308 - CVSS 8.7 (high), 2026-07-09: The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing…
• CVE-2026-4360 - CVSS 5.3 (medium), 2026-06-30: In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from…
• CVE-2026-11972 - CVSS 8.2 (high), 2026-06-23: When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take…
• CVE-2026-0864 - CVSS 5.5 (medium), 2026-06-23: When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file…
• CVE-2026-11940 - CVSS 7.8 (high), 2026-06-23: tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than…
• CVE-2026-12003 - CVSS 5.3 (medium), 2026-06-16: To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to…
• CVE-2026-9669 - CVSS 8.2 (high), 2026-06-08: bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same…
• CVE-2026-7774 - CVSS 6.9 (medium), 2026-06-04: tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members…
• CVE-2026-3276 - CVSS 6.3 (medium), 2026-06-03: unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with…
• CVE-2026-8328 - CVSS 5.9 (medium), 2026-05-13: The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host…
• CVE-2026-7210 - CVSS 7.5 (high), 2026-05-11: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger…
• CVE-2026-3087 - CVSS 7.5 (high), 2026-04-27: If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside…
• CVE-2026-6019 - CVSS 6.1 (medium), 2026-04-22: http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML…
• CVE-2026-3298 - CVSS 8.8 (high), 2026-04-21: The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter.…
• CVE-2026-5713 - CVSS 5.3 (medium), 2026-04-14: The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree")…
• CVE-2026-4786 - CVSS 7.1 (high), 2026-04-13: Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()"…
• CVE-2026-6100 - CVSS 9.1 (critical), 2026-04-13: Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a…
• CVE-2026-3446 - CVSS 6 (medium), 2026-04-10: When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was…
• CVE-2026-1502 - CVSS 5.7 (medium), 2026-04-10: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
• CVE-2026-4519 - CVSS 7.1 (high), 2026-03-20: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects…
• CVE-2026-3479 - CVSS 0 (none), 2026-03-18: DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation…
• CVE-2026-4224 - CVSS 7.5 (high), 2026-03-16: When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack…
• CVE-2026-3644 - CVSS 7.5 (high), 2026-03-16: The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths…
• CVE-2025-13462 - CVSS 3.3 (low), 2026-03-12: The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME…
• CVE-2026-2297 - CVSS 5.7 (medium), 2026-03-04: The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use…
• CVE-2026-1299 - CVSS 6 (medium), 2026-01-23: The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for…
• CVE-2025-12781 - CVSS 6.3 (medium), 2026-01-21: When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be…
• CVE-2026-0672 - CVSS 6 (medium), 2026-01-20: When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control…
• CVE-2026-0865 - CVSS 5.9 (medium), 2026-01-20: User-controlled header names and values containing newlines can allow injecting HTTP headers.
• CVE-2025-15367 - CVSS 5.9 (medium), 2026-01-20: The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control…
• CVE-2025-15366 - CVSS 5.9 (medium), 2026-01-20: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing…
• CVE-2025-15282 - CVSS 6 (medium), 2026-01-20: User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
• CVE-2025-11468 - CVSS 5.7 (medium), 2026-01-20: When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for…
• CVE-2025-12084 - CVSS 6.3 (medium), 2025-12-03: When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic.…
• CVE-2025-13837 - CVSS 5.5 (medium), 2025-12-01: When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
• CVE-2025-13836 - CVSS 7.5 (high), 2025-12-01: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious…
• CVE-2025-6075 - CVSS 5.5 (medium), 2025-10-31: If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
• CVE-2025-8291 - CVSS 4.3 (medium), 2025-10-07: The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the…
• CVE-2025-8194 - CVSS 7.5 (high), 2025-07-28: There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar…
• CVE-2025-6069 - CVSS 4.3 (medium), 2025-06-17: The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified…
• CVE-2025-4330 - CVSS 7.5 (high), 2025-06-03: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.…
• CVE-2025-4138 - CVSS 7.5 (high), 2025-06-03: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.…
• CVE-2025-4517 - CVSS 9.4 (critical), 2025-06-03: Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the…
• CVE-2024-12718 - CVSS 5.3 (medium), 2025-06-03: Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction…
• CVE-2025-4435 - CVSS 7.5 (high), 2025-06-03: When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted.…
• CVE-2025-4516 - CVSS 5.9 (medium), 2025-05-15: There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an…
• CVE-2025-1795 - CVSS 2.3 (low), 2025-02-28: During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also…
• CVE-2024-3220 - CVSS 2.3 (low), 2025-02-14: There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other…
• CVE-2025-0938 - CVSS 6.3 (medium), 2025-01-31: The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according…
• CVE-2024-12254 - CVSS 8.7 (high), 2024-12-06: Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer…
• CVE-2024-11168 - CVSS 6.3 (medium), 2024-11-12: The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior…
• CVE-2024-9287 - CVSS 7.8 (high), 2024-10-22: A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly,…
• CVE-2024-6232 - CVSS 7.5 (high), 2024-09-03: There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are…
• CVE-2024-8088 - CVSS 8.7 (high), 2024-08-22: There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class…
• CVE-2024-7592 - CVSS 7.5 (high), 2024-08-19: There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained…
• CVE-2024-6923 - CVSS 5.5 (medium), 2024-08-01: There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email…
• CVE-2024-3219 - CVSS 5.1 (medium), 2024-07-29: The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This…
• CVE-2024-5642 - CVSS 6.5 (medium), 2024-06-27: CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying…
• CVE-2024-0397 - CVSS 7.4 (high), 2024-06-17: A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and…
• CVE-2024-4032 - CVSS 7.5 (high), 2024-06-17: The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”.…
• CVE-2024-4030 - CVSS 7.1 (high), 2024-05-07: On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by…
• CVE-2024-0450 - CVSS 6.2 (medium), 2024-03-19: An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable…
• CVE-2023-6597 - CVSS 7.8 (high), 2024-03-19: An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The…
• CVE-2023-6507 - CVSS 6.1 (medium), 2023-12-08: An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases.…