Python Software Foundation - vulnerabilities (CVEs)
83 CVEs in 5 products, 6 in the last 30 days, newest from 2026-10-27.
Products
Newest CVEs of Python Software Foundation
- CVE-2026-103995 - CVSS 2 (low), 2026-10-27: Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.
- CVE-2026-115557 - CVSS 9.4 (critical), 2026-10-24: Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known…
- CVE-2026-114583 - CVSS 6.9 (medium), 2026-10-22: tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members…
- CVE-2026-19553 - CVSS 7.6 (high), 2026-09-30: ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter…
- CVE-2026-19445 - CVSS 9.2 (critical), 2026-09-30: A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to…
- CVE-2026-12345 - CVSS 5.9 (medium), 2026-09-29: The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with…
- CVE-2026-82049 - CVSS 8.4 (high), 2026-09-14: In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic…
- CVE-2026-87910 - CVSS 5.7 (medium), 2026-09-11: When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function…
- CVE-2026-15310 - CVSS 2.1 (low), 2026-08-25: When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly…
- CVE-2026-19672 - CVSS 6.3 (medium), 2026-08-19: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to…
- CVE-2026-15806 - CVSS 6 (medium), 2026-08-18: The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not…
- CVE-2026-17084 - CVSS 6 (medium), 2026-08-18: The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the…
- CVE-2026-18503 - CVSS 2.4 (low), 2026-08-10: Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass…
- CVE-2026-6879 - CVSS 2 (low), 2026-07-28: `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`,…
- CVE-2026-15308 - CVSS 8.7 (high), 2026-07-09: The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing…
- CVE-2026-4360 - CVSS 5.3 (medium), 2026-06-30: In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from…
- CVE-2026-11972 - CVSS 8.2 (high), 2026-06-23: When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take…
- CVE-2026-0864 - CVSS 5.5 (medium), 2026-06-23: When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file…
- CVE-2026-11940 - CVSS 7.8 (high), 2026-06-23: tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than…
- CVE-2026-12003 - CVSS 5.3 (medium), 2026-06-16: To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to…
- CVE-2026-9669 - CVSS 8.2 (high), 2026-06-08: bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same…
- CVE-2026-7774 - CVSS 6.9 (medium), 2026-06-04: tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members…
- CVE-2026-3276 - CVSS 6.3 (medium), 2026-06-03: unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with…
- CVE-2026-8328 - CVSS 5.9 (medium), 2026-05-13: The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host…
- CVE-2026-7210 - CVSS 7.5 (high), 2026-05-11: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger…
- CVE-2026-3087 - CVSS 7.5 (high), 2026-04-27: If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside…
- CVE-2026-6019 - CVSS 6.1 (medium), 2026-04-22: http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML…
- CVE-2026-3298 - CVSS 8.8 (high), 2026-04-21: The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter.…
- CVE-2026-5713 - CVSS 5.3 (medium), 2026-04-14: The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree")…
- CVE-2026-4786 - CVSS 7.1 (high), 2026-04-13: Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()"…
