CVE-2026-2297
published 2026-03-04CVE-2026-2297: The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use…
PriorityP424medium5.7CVSS 4.0
AVLACLATPPRLUINVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.20%
10.2th percentile
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pypy3 | < python3.14 3.14.3-4 (sid) | python3.14 3.14.3-4 (sid) |
| debian | python2.7 | < python3.14 3.14.3-4 (sid) | python3.14 3.14.3-4 (sid) |
| debian | python3.11 | < python3.14 3.14.3-4 (sid) | python3.14 3.14.3-4 (sid) |
| debian | python3.13 | < python3.14 3.14.3-4 (sid) | python3.14 3.14.3-4 (sid) |
| debian | python3.14 | < python3.14 3.14.3-4 (sid) | python3.14 3.14.3-4 (sid) |
| debian | python3.9 | < python3.14 3.14.3-4 (sid) | python3.14 3.14.3-4 (sid) |
| msrc | azl3_python3_3.12.9-9_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-11_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python3_3.9.19-19_on_cbl_mariner_2.0 | — | — |
| python_software_foundation | cpython | < 3.13.13 | 3.13.13 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.4 | 3.14.4 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0a7 | 3.15.0a7 |
| ubuntu | python3.10 | — | — |
| ubuntu | python3.12 | — | — |
| ubuntu | python3.14 | — | — |
CVSS provenance
nvdv4.05.7MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv5.7MEDIUM
vendor_debian5.7MEDIUM
vendor_msrc5.7MEDIUM
vendor_redhat5.7MEDIUM
vendor_ubuntu3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 3.3
CVE-2026-9669 [LOW] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly normalized paths in the tarfile
module. An attacker could possibly use this issue to bypass path
restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04
LTS. (CVE-2025-13462)
It was discovered that Python's HTMLParser incorrectly handled certain
malformed HTML input. An attacker could possibly use this issue to cause
Python to crash, resulting in a denial of service. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)
It was discovered that Python's email module incorrectly quoted newlines
in headers. An attacker could possibly use this issue to inject arbitrary
email headers. This issue only affected Ubuntu 22.04 L
Microsoft
SourcelessFileLoader does not use io.open_code()
vendor_msrc·2026-03-10·CVSS 5.7
CVE-2026-2297 [MEDIUM] SourcelessFileLoader does not use io.open_code()
SourcelessFileLoader does not use io.open_code()
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Red Hat
cpython: CPython: Logging Bypass in Legacy .pyc File Handling
vendor_redhat·2026-03-04·CVSS 5.7
CVE-2026-2297 [MEDIUM] CWE-778 cpython: CPython: Logging Bypass in Legacy .pyc File Handling
cpython: CPython: Logging Bypass in Legacy .pyc File Handling
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
A flaw was found in CPython. This vulnerability allows a local user with low privileges to bypass security auditing mechanisms. The issue occurs because the SourcelessFileLoader component, responsible for handling older Python compiled files (.pyc), does not properly trigger system audit events. This oversight could enable malicious activities to go undetected, compromising the integrity of the system.
Mitigation: Mitigation for this issue is either not available or the curr
Debian
CVE-2026-2297: pypy3 - The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader...
vendor_debian·2026·CVSS 5.7
CVE-2026-2297 [MEDIUM] CVE-2026-2297: pypy3 - The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader...
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
GHSA
GHSA-86jh-grmm-2v3h: The import hook in CPython that handles legacy *
ghsa_unreviewed·2026-03-05
CVE-2026-2297 [MEDIUM] CWE-668 GHSA-86jh-grmm-2v3h: The import hook in CPython that handles legacy *
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
OSV
CVE-2026-2297: The import hook in CPython that handles legacy *
osv·2026-03-04·CVSS 5.7
CVE-2026-2297 [MEDIUM] CVE-2026-2297: The import hook in CPython that handles legacy *
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-2297 cpython: CPython: Logging Bypass in Legacy .pyc File Handling
bugzilla·2026-03-04·CVSS 5.7
CVE-2026-2297 [MEDIUM] CVE-2026-2297 cpython: CPython: Logging Bypass in Legacy .pyc File Handling
CVE-2026-2297 cpython: CPython: Logging Bypass in Legacy .pyc File Handling
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Bugzilla
CVE-2026-2297 python3.15: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
bugzilla·2026-03-04·CVSS 5.7
CVE-2026-2297 [MEDIUM] CVE-2026-2297 python3.15: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
CVE-2026-2297 python3.15: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-d494efe6a9 (python3.15-3.15.0~a8-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-d494efe6a9
---
FEDORA-2026-7ea30e843c (python3.15-3.15.0~a8-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-7ea30e843c
---
FEDORA-2026-485183030a (python3.15-3.15.0~a8-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/up
Bugzilla
CVE-2026-2297 mingw-python3: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
bugzilla·2026-03-04·CVSS 5.7
CVE-2026-2297 [MEDIUM] CVE-2026-2297 mingw-python3: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
CVE-2026-2297 mingw-python3: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-22d8c9f967 (mingw-python3-3.11.15-2.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-22d8c9f967
---
FEDORA-2026-3d13d52f58 (mingw-python3-3.11.15-2.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3d13d52f58
---
FEDORA-2026-3d13d52f58 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the f
Bugzilla
CVE-2026-2297 python3.13: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
bugzilla·2026-03-04·CVSS 5.7
CVE-2026-2297 [MEDIUM] CVE-2026-2297 python3.13: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
CVE-2026-2297 python3.13: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-80165205dc (python3.13-3.13.13-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-80165205dc
---
FEDORA-2026-13c6899032 (python3.13-3.13.13-1.fc42 and python3-docs-3.13.13-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-13c6899032
Bugzilla
CVE-2026-2297 python3.12: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
bugzilla·2026-03-04·CVSS 5.7
CVE-2026-2297 [MEDIUM] CVE-2026-2297 python3.12: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
CVE-2026-2297 python3.12: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
PRs:
https://src.fedoraproject.org/rpms/python3.12/pull-request/221
https://src.fedoraproject.org/rpms/python3.12/pull-request/222
https://src.fedoraproject.org/rpms/python3.12/pull-request/223
https://src.fedoraproject.org/rpms/python3.12/pull-request/224
---
FEDORA-2026-2dfcf9d705 (python3.12-3.12.13-3.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-2dfcf9d705
---
FEDORA-2026-2dfcf9d705 (python3.12-3.12.
Bugzilla
CVE-2026-2297 python3.11: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
bugzilla·2026-03-04·CVSS 5.7
CVE-2026-2297 [MEDIUM] CVE-2026-2297 python3.11: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
CVE-2026-2297 python3.11: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
PRs:
https://src.fedoraproject.org/rpms/python3.11/pull-request/229
https://src.fedoraproject.org/rpms/python3.11/pull-request/230
https://src.fedoraproject.org/rpms/python3.11/pull-request/231
https://src.fedoraproject.org/rpms/python3.11/pull-request/232
---
FEDORA-2026-a5ba8297fd (python3.11-3.11.15-4.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a5ba8297fd
---
FEDORA-2026-a5ba8297fd (python3.11-3.11.
Bugzilla
CVE-2026-2297 python3.14: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
bugzilla·2026-03-04·CVSS 5.7
CVE-2026-2297 [MEDIUM] CVE-2026-2297 python3.14: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
CVE-2026-2297 python3.14: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-884eccdb03 (python3.14-3.14.4-1.fc44 and python3-docs-3.14.4-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-884eccdb03
---
FEDORA-2026-9a8fddee0b (python3.14-3.14.4-1.fc43 and python3-docs-3.14.4-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9a8fddee0b
Bugzilla
CVE-2026-2297 python3.13: CPython: Logging Bypass in Legacy .pyc File Handling [epel-all]
bugzilla·2026-03-04·CVSS 5.7
CVE-2026-2297 [MEDIUM] CVE-2026-2297 python3.13: CPython: Logging Bypass in Legacy .pyc File Handling [epel-all]
CVE-2026-2297 python3.13: CPython: Logging Bypass in Legacy .pyc File Handling [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This vulnerability has been fixed upstream in 3.13.13, and that update has been delivered to all EPEL 10.X.
Bleepingcomputer
Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws
blogs_bleepingcomputer·2026-03-10·CVSS 8.8
[HIGH] Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws
## Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws
## Lawrence Abrams
The number of bugs in each vulnerability category is listed below:
46 Elevation of Privilege Vulnerabilities
2 Security Feature Bypass Vulnerabilities
18 Remote Code Execution Vulnerabilities
10 Information Disclosure Vulnerabilities
4 Denial of Service Vulnerabilities
4 Spoofing Vulnerabilities
When BleepingComputer reports on Patch Tuesday security updates, we only count those released by Microsoft today. Therefore, the number of flaws does not include 9 Microsoft Edge flaws, Mariner, Payment Orchestrator Service, Azure, and Microsoft Devices Pricing Program flaws fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the
Wiz
CVE-2026-2297 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 2.0
CVE-2026-2297 [LOW] CVE-2026-2297 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-2297 :
Python Interpreter vulnerability analysis and mitigation
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Source : NVD
## 5.7
Score
Published March 4, 2026
Severity MEDIUM
CNA Score 5.7
Affected Technologies
Python Interpreter
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 4.5
Exploitation Probability (EPSS) N/A
Affected packages and libraries
python39-devel:3.9::python39-psycopg2-tests
python39-devel:3.9::python-wheel
Sources
NVD
Chainguard Has Fix
https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603ehttps://github.com/python/cpython/commit/69ddd9bb2cc4bd69b1565647c18659c6a789ccd9https://github.com/python/cpython/commit/876858c9f65d9ab656c7fa639f268ce7856d89ddhttps://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535ehttps://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86https://github.com/python/cpython/issues/145506https://github.com/python/cpython/pull/145507http://www.openwall.com/lists/oss-security/2026/03/05/6
2026-03-04
Published