Python Software Foundation Cpython vulnerabilities

CVE-2024-5535 [CRITICAL] CWE-125 CVE-2024-5535: Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in

CVE-2025-4517 [CRITICAL] CWE-22 CVE-2025-4517: Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="d Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters

CVE-2026-3298 [HIGH] CWE-787 CVE-2026-3298: The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a bounda The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.

CVE-2026-6100 [HIGH] CWE-416 CVE-2026-6100: Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.G Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The v

CVE-2024-8088 [HIGH] CWE-835 CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Pat There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with

CVE-2025-4138 [HIGH] CWE-22 CVE-2025-4138: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destinatio Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "dat

CVE-2026-9669 [HIGH] CWE-121 CVE-2026-9669: bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught th bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data

CVE-2025-4330 [HIGH] CWE-22 CVE-2025-4330: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destinatio Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "dat

CVE-2025-13836 [HIGH] CWE-400 CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default behavior wi When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

CVE-2026-7210 [HIGH] CWE-331 CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding pro `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

CVE-2026-3087 [HIGH] CWE-22 CVE-2026-3087: If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

CVE-2024-12254 [HIGH] CWE-400 CVE-2024-12254: Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "paus Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerabil

CVE-2024-9287 [HIGH] CWE-428 CVE-2024-9287: A vulnerability has been found in the CPython `venv` module and CLI where path names provided when c A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run command

CVE-2024-4032 [HIGH] CWE-697 CVE-2024-4032: The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned i

CVE-2023-6597 [HIGH] CVE-2023-6597: An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.1 An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files refe

CVE-2026-4224 [HIGH] CWE-674 CVE-2026-4224: When an Expat parser with a registered ElementDeclHandler parses an inline document type definition When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

CVE-2026-11972 [HIGH] CWE-252 CVE-2026-11972: When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile modul When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

CVE-2024-0397 [HIGH] CWE-362 CVE-2024-0397: A defect was discovered in the Python “ssl” module where there is a memory race condition with the s A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory c

CVE-2025-4435 [HIGH] CWE-682 CVE-2025-4435: When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.

CVE-2024-7592 [HIGH] CWE-400 CVE-2024-7592: There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard li There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.