Python Software Foundation Cpython vulnerabilities

CVE-2026-17084 [MEDIUM] CWE-436 CVE-2026-17084: The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the la The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only

CVE-2026-0865 [MEDIUM] CWE-74 CVE-2026-0865: User-controlled header names and values containing newlines can allow injecting HTTP headers. User-controlled header names and values containing newlines can allow injecting HTTP headers.

CVE-2026-3446 [MEDIUM] CWE-345 CVE-2026-3446: When calling base64.b64decode() or related functions the decoding process would stop after encounter When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 dat

CVE-2026-12345 [MEDIUM] CWE-59 CVE-2026-12345: The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can mo The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note th

CVE-2025-12781 [MEDIUM] CWE-704 CVE-2025-12781: When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in ear

CVE-2026-4360 [MEDIUM] CWE-281 CVE-2026-4360: In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardl In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

CVE-2026-114583 [MEDIUM] CVE-2026-114583: tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or di tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permission

CVE-2026-87910 [MEDIUM] CWE-22 CVE-2026-87910: When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a m When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if eith

CVE-2026-1502 [MEDIUM] CWE-93 CVE-2026-1502: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

CVE-2025-12084 [MEDIUM] CWE-407 CVE-2025-12084: When building nested elements using xml.dom.minidom methods such as appendChild() that have a depend When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

CVE-2025-11468 [MEDIUM] CWE-93 CVE-2025-11468: When folding a long comment in an email header containing exclusively unfoldable characters, the par When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

CVE-2024-6923 [MEDIUM] CWE-94 CVE-2024-6923: There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

CVE-2026-6019 [MEDIUM] CWE-150 CVE-2026-6019: http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

CVE-2026-0864 [MEDIUM] CWE-74 CVE-2026-0864: When using the "configparser" module to write configuration files containing multi-line text values When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

CVE-2023-6507 [MEDIUM] CWE-269 CVE-2023-6507: An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the o

CVE-2026-12003 [MEDIUM] CWE-427 CVE-2026-12003: To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), t To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates

CVE-2024-0450 [MEDIUM] CWE-405 CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.1 An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which ov

CVE-2026-2297 [MEDIUM] CWE-668 CVE-2026-2297: The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly han The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.

CVE-2024-3219 [MEDIUM] CWE-306 CVE-2024-3219: The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platfo The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create a local connected pair of sockets. The connection between the two sockets was not verified before passing the two sockets back to the user, w

CVE-2025-4516 [MEDIUM] CWE-416 CVE-2025-4516: There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.