CVE-2026-15806 | | | 2026-08-18 | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not tak… |
CVE-2026-17084 | | | 2026-08-18 | The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the… |
CVE-2026-18503 | | | 2026-08-10 | Attacker-controlled CSV samples can trigger super-linear
regular-expression work during dialect sniffing and consume significant
CPU when applications pass u… |
CVE-2026-6879 | | | 2026-07-28 | `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last(… |
CVE-2026-15308 | High | 7.5 | 2026-07-09 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU
denial-of-service through repeated unterminated markup declarations when
processing uncontr… |
CVE-2026-4360 | Medium | 5.3 | 2026-06-30 | In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrust… |
CVE-2026-11972 | | | 2026-06-23 | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take… |
CVE-2026-0864 | Medium | 5.5 | 2026-06-23 | When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file cou… |
CVE-2026-11940 | | | 2026-06-23 | tarfile.extractall() with the 'data' or 'tar'
filter could be bypassed by a crafted archive where a hardlink
references a symlink stored at a deeper name tha… |
CVE-2026-12003 | | | 2026-06-16 | To allow builds of Python to be run from an in-tree layout (rather than
an installed file layout), the VPATH variable is defined at build time
and used to loca… |
CVE-2026-9669 | | | 2026-06-08 | bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor… |
CVE-2026-7774 | | | 2026-06-04 | tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outs… |
CVE-2026-3276 | | | 2026-06-03 | unicodedata.normalize() can take excessive CPU time when processing
specially crafted Unicode input containing long runs of combining characters
with alternati… |
CVE-2026-8328 | | | 2026-05-13 | The ftpcp() function in Lib/ftplib.py was not updated when
CVE-2021-4189 was fixed. While makepasv() was patched to replace
server-supplied PASV host address… |
CVE-2026-7210 | High | 7.5 | 2026-05-11 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger has… |
CVE-2026-3087 | High | 7.5 | 2026-04-27 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the… |
CVE-2026-6019 | Medium | 6.1 | 2026-04-22 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sen… |
CVE-2026-3298 | | | 2026-04-21 | The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. T… |
CVE-2026-5713 | | | 2026-04-14 | The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features… |
CVE-2026-4786 | High | 7.1 | 2026-04-13 | Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" AP… |
CVE-2026-6100 | High | 8.1 | 2026-04-13 | Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError… |
CVE-2026-3446 | | | 2026-04-10 | When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was m… |
CVE-2026-1502 | | | 2026-04-10 | CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. |
CVE-2026-5271 | High | 7.8 | 2026-04-01 | pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a u… |
CVE-2026-4519 | Low | 3.3 | 2026-03-20 | The webbrowser.open() API would accept leading dashes in the URL which
could be handled as command line options for certain web browsers. New
behavior reject… |
CVE-2026-3479 | | | 2026-03-18 | DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation… |
CVE-2026-4224 | High | 7.5 | 2026-03-16 | When an Expat parser with a registered ElementDeclHandler parses an inline
document type definition containing a deeply nested content model a C stack
overflow… |
CVE-2026-3644 | High | 7.5 | 2026-03-16 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths wer… |
CVE-2025-13462 | Low | 3.3 | 2026-03-12 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME… |
CVE-2026-2297 | | | 2026-03-04 | The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.op… |
CVE-2026-1299 | | | 2026-01-23 | The
email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when
serializing an email message allowing for he… |
CVE-2025-12781 | Medium | 5.3 | 2026-01-21 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepte… |
CVE-2026-0865 | | | 2026-01-20 | User-controlled header names and values containing newlines can allow injecting HTTP headers. |
CVE-2026-0672 | | | 2026-01-20 | When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characte… |
CVE-2025-15367 | | | 2026-01-20 | The poplib module, when passed a user-controlled command, can have
additional commands injected using newlines. Mitigation rejects commands
containing control… |
CVE-2025-15366 | | | 2026-01-20 | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control… |
CVE-2025-15282 | | | 2026-01-20 | User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype. |
CVE-2025-11468 | | | 2026-01-20 | When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for inj… |
CVE-2025-12084 | Medium | 5.3 | 2025-12-03 | When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Avail… |
CVE-2025-13837 | Medium | 5.5 | 2025-12-01 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues |
CVE-2025-13836 | High | 7.5 | 2025-12-01 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server… |
CVE-2025-6075 | Medium | 5.5 | 2025-10-31 | If the value passed to os.path.expandvars() is user-controlled a
performance degradation is possible when expanding environment
variables. |
CVE-2025-8291 | Medium | 4.3 | 2025-10-07 | The 'zipfile' module would not check the validity of the ZIP64 End of
Central Directory (EOCD) Locator record offset value would not be used to
locate the ZIP6… |
CVE-2025-8194 | High | 7.5 | 2025-07-28 | There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archi… |
CVE-2025-6069 | Medium | 4.3 | 2025-06-17 | The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-o… |
CVE-2025-4517 | Critical | 9.4 | 2025-06-03 | Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data".
You are affected by this vulnerability if using the… |
CVE-2025-4435 | High | 7.5 | 2025-06-03 | When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. Howev… |
CVE-2025-4330 | High | 7.5 | 2025-06-03 | Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
… |
CVE-2025-4138 | High | 7.5 | 2025-06-03 | Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
… |
CVE-2024-12718 | Medium | 5.3 | 2025-06-03 | Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction direc… |
CVE-2025-4516 | | | 2025-05-15 | There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an erro… |
CVE-2025-1795 | | | 2025-02-28 | During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicod… |
CVE-2024-3220 | | | 2025-02-14 | There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users… |
CVE-2025-0938 | | | 2025-01-31 | The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to… |
CVE-2024-12254 | High | 7.5 | 2024-12-06 | Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()
method would not "pause" writing and signal to the Protocol to drain
the buffer… |
CVE-2024-11168 | Low | 3.7 | 2024-11-12 | The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior… |
CVE-2024-9287 | High | 7.8 | 2024-10-22 | A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, all… |
CVE-2024-6232 | High | 7.5 | 2024-09-03 | There is a MEDIUM severity vulnerability affecting CPython.
Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing… |
CVE-2024-8088 | | | 2024-08-22 | There is a HIGH severity vulnerability affecting the CPython "zipfile"
module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class i… |
CVE-2024-7592 | High | 7.5 | 2024-08-19 | There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.
When parsing cookies that contained backsla… |
CVE-2024-6923 | Medium | 5.5 | 2024-08-01 | There is a MEDIUM severity vulnerability affecting CPython.
The
email module didn’t properly quote newlines for email headers when
serializing an email mess… |
CVE-2024-3219 | | | 2024-07-29 | The
“socket” module provides a pure-Python fallback to the
socket.socketpair() function for platforms that don’t support AF_UNIX,
such as Windows. This pure… |
CVE-2024-5642 | Medium | 6.5 | 2024-06-27 | CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenS… |
CVE-2024-0397 | High | 7.4 | 2024-06-17 | A defect was discovered in the Python “ssl” module where there is a memory
race condition with the ssl.SSLContext methods “cert_store_stats()” and
“get_ca_cert… |
CVE-2024-4032 | High | 7.5 | 2024-06-17 | The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This… |
CVE-2024-4030 | High | 7.1 | 2024-05-07 | On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other… |
CVE-2024-0450 | Medium | 6.2 | 2024-03-19 | An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The zipfile module is vulnerable… |
CVE-2023-6597 | High | 7.8 | 2024-03-19 | An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The tempfile.T… |
CVE-2023-6507 | Medium | 6.1 | 2023-12-08 | An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases.
… |