Python Software Foundation Cpython vulnerabilities

CVE-2024-6232 [HIGH] CWE-1333 CVE-2024-6232: There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed ex There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

CVE-2025-8194 [HIGH] CWE-835 CVE-2025-8194: There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enume There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the fo

CVE-2026-15308 [HIGH] CWE-400 CVE-2026-15308: The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeat The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

CVE-2026-3276 [MEDIUM] CWE-407 CVE-2026-3276: unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

CVE-2026-7774 [MEDIUM] CWE-22 CVE-2026-7774: tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or d tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extra

CVE-2026-1299 [MEDIUM] CWE-93 CVE-2026-1299: The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly fold

CVE-2025-15282 [MEDIUM] CWE-93 CVE-2025-15282: User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newli User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

CVE-2026-0672 [MEDIUM] CWE-93 CVE-2026-0672: When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTT When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

CVE-2025-15366 [MEDIUM] CWE-77 CVE-2025-15366: The imaplib module, when passed a user-controlled command, can have additional commands injected usi The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

CVE-2025-15367 [MEDIUM] CWE-77 CVE-2025-15367: The poplib module, when passed a user-controlled command, can have additional commands injected usin The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

CVE-2025-0938 [MEDIUM] CWE-20 CVE-2025-0938: The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names t The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and othe

CVE-2024-4030 [HIGH] CWE-276 CVE-2024-4030: On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restr On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’r

CVE-2024-12718 [MEDIUM] CWE-22 CVE-2024-12718: Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chm Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a val

CVE-2021-4189 [MEDIUM] CWE-252 CVE-2021-4189: A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerab

CVE-2026-0865 [MEDIUM] CWE-74 CVE-2026-0865: User-controlled header names and values containing newlines can allow injecting HTTP headers. User-controlled header names and values containing newlines can allow injecting HTTP headers.

CVE-2026-3446 [MEDIUM] CWE-345 CVE-2026-3446: When calling base64.b64decode() or related functions the decoding process would stop after encounter When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 dat

CVE-2026-4360 [MEDIUM] CWE-281 CVE-2026-4360: In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardl In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

CVE-2026-1502 [MEDIUM] CWE-93 CVE-2026-1502: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

CVE-2025-11468 [MEDIUM] CWE-93 CVE-2025-11468: When folding a long comment in an email header containing exclusively unfoldable characters, the par When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

CVE-2025-12084 [MEDIUM] CWE-407 CVE-2025-12084: When building nested elements using xml.dom.minidom methods such as appendChild() that have a depend When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.