Python Software Foundation Cpython vulnerabilities

CVE-2025-12781 [MEDIUM] CWE-704 CVE-2025-12781: When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in ear

CVE-2024-6923 [MEDIUM] CWE-94 CVE-2024-6923: There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

CVE-2026-6019 [MEDIUM] CWE-150 CVE-2026-6019: http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

CVE-2023-6507 [MEDIUM] CWE-269 CVE-2023-6507: An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the o

CVE-2026-12003 [MEDIUM] CWE-427 CVE-2026-12003: To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), t To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates

CVE-2024-0450 [MEDIUM] CWE-405 CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.1 An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which ov

CVE-2026-2297 [MEDIUM] CWE-668 CVE-2026-2297: The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly han The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.

CVE-2024-3219 [MEDIUM] CWE-306 CVE-2024-3219: The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platfo The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create a local connected pair of sockets. The connection between the two sockets was not verified before passing the two sockets back to the user, w

CVE-2026-5713 [MEDIUM] CWE-121 CVE-2026-5713: The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "pyt The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requ

CVE-2025-4516 [MEDIUM] CWE-416 CVE-2025-4516: There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

CVE-2025-6075 [MEDIUM] CWE-400 CVE-2025-6075: If the value passed to os.path.expandvars() is user-controlled a performance degradation is possibl If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

CVE-2025-13837 [MEDIUM] CWE-400 CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file itself, mean When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

CVE-2025-8291 [MEDIUM] CWE-1285 CVE-2025-8291: The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locat The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipf

CVE-2025-6069 [MEDIUM] CWE-1333 CVE-2025-6069: The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

CVE-2026-0864 [MEDIUM] CWE-74 CVE-2026-0864: When using the "configparser" module to write configuration files containing multi-line text values When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

CVE-2024-11168 [LOW] CWE-918 CVE-2024-11168: The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), al The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

CVE-2026-4519 [LOW] CWE-20 CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

CVE-2026-3479 [NONE] CWE-22 CVE-2026-3479: DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data( DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented,

CVE-2025-13462 [LOW] CWE-20 CVE-2025-13462: The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even whil The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

CVE-2024-3220 [LOW] CWE-426 CVE-2024-3220: There is a defect in the CPython standard library module “mimetypes” where on Windows the default li There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locati