Python Software Foundation Cpython vulnerabilities

CVE-2026-5713 [MEDIUM] CWE-121 CVE-2026-5713: The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "pyt The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requ

CVE-2025-6075 [MEDIUM] CWE-400 CVE-2025-6075: If the value passed to os.path.expandvars() is user-controlled a performance degradation is possibl If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

CVE-2025-13837 [MEDIUM] CWE-400 CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file itself, mean When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

CVE-2025-8291 [MEDIUM] CWE-1285 CVE-2025-8291: The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locat The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipf

CVE-2025-6069 [MEDIUM] CWE-1333 CVE-2025-6069: The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

CVE-2026-15310 [LOW] CWE-400 CVE-2026-15310: When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.

CVE-2024-11168 [LOW] CWE-918 CVE-2024-11168: The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), al The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

CVE-2026-4519 [LOW] CWE-20 CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

CVE-2026-3479 [NONE] CWE-22 CVE-2026-3479: DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data( DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented,

CVE-2024-3220 [LOW] CWE-426 CVE-2024-3220: There is a defect in the CPython standard library module “mimetypes” where on Windows the default li There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locati

CVE-2026-6879 [LOW] CWE-407 CVE-2026-6879: `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when us `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]

CVE-2025-13462 [LOW] CWE-20 CVE-2025-13462: The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even whil The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

CVE-2025-1795 [LOW] CWE-116 CVE-2025-1795: During an address list folding when a separating comma ends up on a folded line and that line is to During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.

CVE-2026-18503 [LOW] CWE-1176 CVE-2026-18503: Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sni Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().