Python Software Foundation vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-115557 Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured.Critical 9.4 · Oct 24, 2026
• CVE-2026-19553 ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set.High 7.6 · Sep 30, 2026
• CVE-2026-19445 A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.contexCritical 9.2 · Sep 30, 2026
• CVE-2026-82049 In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link.High 8.4 · Sep 14, 2026
• CVE-2026-15308 The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontroHigh 8.7 · Jul 9, 2026
• CVE-2026-11972 When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take eHigh 8.2 · Jun 23, 2026
• CVE-2026-11940 tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name thanHigh 7.8 · Jun 23, 2026
• CVE-2026-9669 bz2.BZ2Decompressor objects could be reused after a decompression error.High 8.2 · Jun 8, 2026
• CVE-2026-3298 The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter.High 8.8 · Apr 21, 2026
• CVE-2026-4786 Mitgation of CVE-2026-4519 was incomplete.High 7 · Apr 13, 2026
• CVE-2026-6100 Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError`Critical 9.1 · Apr 13, 2026
• CVE-2026-4519 The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.High 7 · Mar 20, 2026
• CVE-2025-8194 There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs.High 7.5 · Jul 28, 2025
• CVE-2025-4517 Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data".Critical 9.4 · Jun 3, 2025
• CVE-2025-4435 When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted.High 7.5 · Jun 3, 2025
• CVE-2025-4330 Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.High 7.5 · Jun 3, 2025
• CVE-2025-4138 Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.High 7.5 · Jun 3, 2025
• CVE-2024-12254 Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer tHigh 8.7 · Dec 6, 2024
• CVE-2024-6232 There is a MEDIUM severity vulnerability affecting CPython.High 7.5 · Sep 3, 2024
• CVE-2024-8088 There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path".High 8.7 · Aug 22, 2024
• CVE-2024-7592 There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module.High 7.5 · Aug 19, 2024
• CVE-2024-0397 A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certsHigh 7.4 · Jun 17, 2024
• CVE-2024-4032 The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”.High 7.5 · Jun 17, 2024
• CVE-2024-4030 On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other High 7.1 · May 7, 2024
• CVE-2023-6597 An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.High 7.8 · Mar 19, 2024