Python Software Foundation Cpython vulnerabilities

CVE-2024-5535 [CRITICAL] CWE-125 CVE-2024-5535: Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in

CVE-2025-4517 [CRITICAL] CWE-22 CVE-2025-4517: Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="d Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters

CVE-2026-19445 [CRITICAL] CWE-416 CVE-2026-19445: A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or

CVE-2026-3298 [HIGH] CWE-787 CVE-2026-3298: The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a bounda The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.

CVE-2026-6100 [HIGH] CWE-416 CVE-2026-6100: Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.G Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The v

CVE-2026-115557 [CRITICAL] CWE-299 CVE-2026-115557: Python has added a denylist for known compromised certificates to the "ssl" module to ensure user sa Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

CVE-2025-4138 [HIGH] CWE-22 CVE-2025-4138: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destinatio Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "dat

CVE-2024-8088 [HIGH] CWE-835 CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Pat There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with

CVE-2025-4330 [HIGH] CWE-22 CVE-2025-4330: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destinatio Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "dat

CVE-2026-11972 [HIGH] CWE-252 CVE-2026-11972: When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile modul When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

CVE-2026-9669 [HIGH] CWE-121 CVE-2026-9669: bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught th bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data

CVE-2026-19553 [HIGH] CWE-297 CVE-2026-19553: ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLConte ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *

CVE-2026-7210 [HIGH] CWE-331 CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding pro `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

CVE-2026-3087 [HIGH] CWE-22 CVE-2026-3087: If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

CVE-2024-12254 [HIGH] CWE-400 CVE-2024-12254: Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "paus Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerabil

CVE-2025-13836 [HIGH] CWE-400 CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default behavior wi When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

CVE-2024-9287 [HIGH] CWE-428 CVE-2024-9287: A vulnerability has been found in the CPython `venv` module and CLI where path names provided when c A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run command

CVE-2024-4032 [HIGH] CWE-697 CVE-2024-4032: The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned i

CVE-2023-6597 [HIGH] CVE-2023-6597: An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.1 An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files refe

CVE-2026-4224 [HIGH] CWE-674 CVE-2026-4224: When an Expat parser with a registered ElementDeclHandler parses an inline document type definition When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.