Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

CPython — Vulnerabilities & Security Advisories 65

All 65 CVE vulnerabilities found in CPython, with AI-generated Chinese analysis, references, and POCs.

This page provides a comprehensive aggregation of Common Weakness Enumeration (CWE) vulnerabilities associated with the CPython software developed by the Python Software Foundation. It serves as a centralized resource for tracking security flaws ranging from memory corruption issues to logic errors within the Python interpreter and its standard library components. The content collected here spans historical records up to the present day, capturing the evolution of security practices and the remediation efforts applied over time. By consolidating data from various advisory sources, this repository offers a holistic view of the threat landscape specific to CPython implementations. Users can leverage this information to monitor vendor advisories for timely updates, gain a deeper understanding of specific weakness classes by analyzing their manifestations in Python code, and explore the complete vulnerability history of the product to assess long-term security trends. Whether you are a developer seeking to patch critical flaws, a security researcher analyzing attack surfaces, or a system administrator ensuring compliance, this page provides the necessary context and historical data to make informed decisions. The aggregated details highlight not only individual vulnerabilities but also broader patterns that inform security hardening strategies for CPython environments.

Vendor: Python Software Foundation

CVE IDTitleCVSSSeverityPublished
CVE-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates 2.0 Low2026-07-28
CVE-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations CWE-400 8.7 High2026-07-09
CVE-2026-4360 Tarfile.extract() doesn't fully respect filter parameter CWE-281 2.0 Low2026-06-30
CVE-2026-11972 tarfile opened in streaming mode mishandles EOF CWE-252 8.2 High2026-06-23
CVE-2026-0864 Configuration Injection via Carriage Return (\r) in write() method 4.1 Medium2026-06-23
CVE-2026-11940 tarfile extraction filter bypass allows escaping the destination directory CWE-22 7.8 High2026-06-23
CVE-2026-12003 CPython >3.11 Insecure Input Validation resulting in privilege escalation CWE-427 5.3 Medium2026-06-16
CVE-2026-9669 bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow CWE-121 8.2 High2026-06-08
CVE-2026-7774 tarfile.data_filter path traversal bypass allows writing outside the extraction directory CWE-22--2026-06-04
CVE-2026-3276 Potential DoS via quadratic complexity in unicodedata.normalize() CWE-407 6.3 Medium2026-06-03
CVE-2026-8328 FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address CWE-918--2026-05-13
CVE-2026-7210 The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection CWE-331--2026-05-11
CVE-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs CWE-22 6.0 Medium2026-04-27
CVE-2026-6019 BaseCookie.js_output() does not neutralize embedded characters CWE-150 6.1AIMediumAI2026-04-22
CVE-2026-3298 Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes CWE-787 8.8 High2026-04-21
CVE-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target CWE-121 5.3 Medium2026-04-14
CVE-2026-4786 Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() CWE-77 7.0 High2026-04-13
CVE-2026-6100 Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure CWE-416 9.1 Critical2026-04-13
CVE-2026-3446 Base64 decoding stops at first padded quad by default 8.2AIHighAI2026-04-10
CVE-2026-1502 HTTP client proxy tunnel headers not validated for CR/LF 7.5AIHighAI2026-04-10
CVE-2026-4519 webbrowser.open() allows leading dashes in URLs 8.2 -2026-03-20
CVE-2026-3479 pkgutil.get_data() does not enforce documented restrictions 7.5 -2026-03-18
CVE-2026-4224 Stack overflow parsing XML with deeply nested DTD content models 6.0 Medium2026-03-16
CVE-2026-3644 Incomplete control character validation in http.cookies 6.0 Medium2026-03-16
CVE-2025-13462 tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling 6.5AIMediumAI2026-03-12
CVE-2026-2297 SourcelessFileLoader does not use io.open_code() 5.7 Medium2026-03-04
CVE-2026-1299 email BytesGenerator header injection due to unquoted newlines CWE-93 4.3 -2026-01-23
CVE-2025-12781 base64.b64decode() always accepts "+/" characters, despite setting altchars 7.5AIHighAI2026-01-21
CVE-2026-0672 Header injection in http.cookies.Morsel CWE-93 4.3AIMediumAI2026-01-20
CVE-2025-15367 POP3 command injection in user-controlled commands CWE-77 9.8AICriticalAI2026-01-20

All 65 known CVE vulnerabilities affecting CPython with full Chinese analysis, references, and POCs where available.