Python Software Foundation Cpython vulnerabilities

CVE-2025-4435 [HIGH] CWE-682 CVE-2025-4435: When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.

CVE-2024-0397 [HIGH] CWE-362 CVE-2024-0397: A defect was discovered in the Python “ssl” module where there is a memory race condition with the s A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory c

CVE-2026-82049 [HIGH] CWE-59 CVE-2026-82049: In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

CVE-2024-6232 [HIGH] CWE-1333 CVE-2024-6232: There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed ex There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

CVE-2026-15308 [HIGH] CWE-400 CVE-2026-15308: The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeat The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

CVE-2024-7592 [HIGH] CWE-400 CVE-2024-7592: There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard li There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

CVE-2025-8194 [HIGH] CWE-835 CVE-2025-8194: There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enume There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the fo

CVE-2026-3276 [MEDIUM] CWE-407 CVE-2026-3276: unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

CVE-2026-7774 [MEDIUM] CWE-22 CVE-2026-7774: tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or d tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extra

CVE-2026-19672 [MEDIUM] CWE-22 CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination fo The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside t

CVE-2026-15806 [MEDIUM] CWE-319 CVE-2026-15806: The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWit The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an a

CVE-2025-0938 [MEDIUM] CWE-20 CVE-2025-0938: The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names t The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and othe

CVE-2026-1299 [MEDIUM] CWE-93 CVE-2026-1299: The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly fold

CVE-2025-15366 [MEDIUM] CWE-77 CVE-2025-15366: The imaplib module, when passed a user-controlled command, can have additional commands injected usi The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

CVE-2025-15282 [MEDIUM] CWE-93 CVE-2025-15282: User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newli User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

CVE-2026-0672 [MEDIUM] CWE-93 CVE-2026-0672: When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTT When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

CVE-2025-15367 [MEDIUM] CWE-77 CVE-2025-15367: The poplib module, when passed a user-controlled command, can have additional commands injected usin The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

CVE-2024-4030 [HIGH] CWE-276 CVE-2024-4030: On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restr On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’r

CVE-2021-4189 [MEDIUM] CWE-252 CVE-2021-4189: A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerab

CVE-2024-12718 [MEDIUM] CWE-22 CVE-2024-12718: Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chm Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a val