Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
93 results · page 1 of 2
Oct 27, 2026Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.CVE-2026-103995 · Other software · Python Software Foundation · reported by cna@python.orgLow 2
Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured.CVE-2026-115557 · Other software · Python Software Foundation · reported by cna@python.orgCritical 9.4
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comemudhra.we-have-a-problem.com
Oct 22, 2026tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outsidCVE-2026-114583 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.9
tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set.CVE-2026-19553 · Other software · Python Software Foundation · reported by cna@python.orgHigh 7.6
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.contexCVE-2026-19445 · Other software · Python Software Foundation · reported by cna@python.orgCritical 9.2
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition.CVE-2026-12345 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.9
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link.CVE-2026-82049 · Other software · Python Software Foundation · reported by cna@python.orgHigh 8.4
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.CVE-2026-87910 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.7
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibCVE-2026-15310 · Other software · Python Software Foundation · reported by cna@python.orgLow 2.1
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to CVE-2026-19672 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.3
The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not takeCVE-2026-15806 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the CVE-2026-17084 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unCVE-2026-18503 · Other software · Python Software Foundation · reported by cna@python.orgLow 2.4
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g.CVE-2026-6879 · Other software · Python Software Foundation · reported by cna@python.orgLow 2
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontroCVE-2026-15308 · Other software · Python Software Foundation · reported by cna@python.orgHigh 8.7
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.CVE-2026-4360 · Other software · Python Software Foundation · reported by cna@python.orgLow 2
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2026When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take eCVE-2026-11972 · Other software · Python Software Foundation · reported by cna@python.orgHigh 8.2
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2026When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file coulCVE-2026-0864 · Other software · Python Software Foundation · reported by cna@python.orgMedium 4.1
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2026tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name thanCVE-2026-11940 · Other software · Python Software Foundation · reported by cna@python.orgHigh 7.8
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locatCVE-2026-12003 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.3
To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree. On Windows, since builds are written to 'PCbuild/', the value of VPATH is set to '..\..', which results in a landmark of '..\..\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative `Lib` folder that will be discovered by an otherwise restricted install. Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive. Our recommended mitigation on Windows is to migrate away from the legacy installer and use the new [Python install manager
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026bz2.BZ2Decompressor objects could be reused after a decompression error.CVE-2026-9669 · Other software · Python Software Foundation · reported by cna@python.orgHigh 8.2
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outsiCVE-2026-7774 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.9
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternatinCVE-2026-3276 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.3
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed.CVE-2026-8328 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.9
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hashCVE-2026-7210 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.3
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the CVE-2026-3087 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context.CVE-2026-6019 · Other software · Python Software Foundation · reported by cna@python.orgLow 2.1
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter.CVE-2026-3298 · Other software · Python Software Foundation · reported by cna@python.orgHigh 8.8
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features CVE-2026-5713 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.3
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Mitgation of CVE-2026-4519 was incomplete.CVE-2026-4786 · Other software · Python Software Foundation · reported by cna@python.orgHigh 7
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError`CVE-2026-6100 · Other software · Python Software Foundation · reported by cna@python.orgCritical 9.1
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was moCVE-2026-3446 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.CVE-2026-1502 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.7
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Lupa integrates the runtimes of Lua or LuaJIT2 into CPython.CVE-2026-34444 · Other software · scoder · reported by GitHubHigh 7.9
Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.
- Product
- lupa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Mar 20, 2026The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.CVE-2026-4519 · Other software · Python Software Foundation · reported by cna@python.orgHigh 7
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open().CVE-2026-3479 · Other software · Python Software Foundation · reported by cna@python.orgNone
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow CVE-2026-4224 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete.CVE-2026-3644 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME oCVE-2025-13462 · Other software · Python Software Foundation · reported by cna@python.orgLow 2
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.opeCVE-2026-2297 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.7
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for heaCVE-2026-1299 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be acceptedCVE-2025-12781 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.3
When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alph
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.9
User-controlled header names and values containing newlines can allow injecting HTTP headers.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages.CVE-2026-0672 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026The poplib module, when passed a user-controlled command, can have additional commands injected using newlines.CVE-2025-15367 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.9
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines.CVE-2025-15366 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.9
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.CVE-2025-15282 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved.CVE-2025-11468 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.7
When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic.CVE-2025-12084 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.3
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issuesCVE-2025-13837 · Other software · Python Software Foundation · reported by cna@python.orgLow 2.1
When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.