Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

CPython — Vulnerabilities & Security Advisories 80

All 80 CVE vulnerabilities found in CPython, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting the CPython reference implementation of the Python programming language, specifically focusing on implementation flaws and memory safety issues within the interpreter. The collection encompasses historical and recent reports spanning from the early days of the project through the current stable releases, capturing defects related to buffer overflows, denial of service conditions, and improper input validation. Readers can utilize this resource to track official advisories issued by the Python core development team, analyze the evolution of specific weakness classes such as integer overflows or code injection vectors, and review the complete vulnerability history for the CPython product line. The data presented here serves as a factual record for security researchers, system administrators, and developers seeking to understand the risk landscape associated with this widely deployed software. By consolidating information from various sources, the page provides a centralized view of known security gaps without requiring users to navigate multiple disparate databases. This compilation supports proactive risk management efforts by enabling stakeholders to identify patterns in reported issues and assess the long-term security posture of their Python environments. The content remains strictly technical and objective, offering clear details on vulnerability descriptions, affected versions, and remediation timelines as documented by the vendor.

Vendor: Python Software Foundation

CVE ID Title CVSS Severity Published
CVE-2026-119170 Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10 8.2 High 2026-11-06
CVE-2026-116566 socket.getaddrinfo() accepts embedded null bytes in host and port CWE-158 5.3 Medium 2026-10-29
CVE-2026-103995 Lenient parsing of integers for response body and chunk framing CWE-444 2.0 Low 2026-10-27
CVE-2026-115557 Distrust compromised intermediate certificates in ssl module CWE-299 9.4 Critical 2026-10-24
CVE-2026-114583 tar filter allows writing outside destination via empty-named symlink 6.9 Medium 2026-10-22
CVE-2026-19553 SSLContext.wrap_bio() missing validation of server_hostname parameter CWE-297 7.6 High 2026-09-30
CVE-2026-19445 Use-after-free of a server-side SSLContext when sni_callback switches contexts CWE-416 9.2 Critical 2026-09-30
CVE-2026-12345 Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory 5.9 Medium 2026-09-29
CVE-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink CWE-59 8.4 High 2026-09-14
CVE-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None CWE-22 5.7 Medium 2026-09-11
CVE-2026-15310 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits CWE-400 2.1 Low 2026-08-25
CVE-2026-19672 tarfile extraction filter bypass allows creation of directories outside the destination 6.3 Medium 2026-08-19
CVE-2026-15806 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CWE-319 6.0 Medium 2026-08-18
CVE-2026-17084 stringprep.map_table_b2() deviates from RFC 3454 Table B.2 6.0 Medium 2026-08-18
CVE-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() CWE-1176 2.4 Low 2026-08-10
CVE-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates 2.0 Low 2026-07-28
CVE-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations CWE-400 8.7 High 2026-07-09
CVE-2026-4360 Tarfile.extract() doesn't fully respect filter parameter CWE-281 2.0 Low 2026-06-30
CVE-2026-11972 tarfile opened in streaming mode mishandles EOF CWE-252 8.2 High 2026-06-23
CVE-2026-0864 Configuration Injection via Carriage Return (\r) in write() method 4.1 Medium 2026-06-23
CVE-2026-11940 tarfile extraction filter bypass allows escaping the destination directory CWE-22 7.8 High 2026-06-23
CVE-2026-12003 CPython >3.11 Insecure Input Validation resulting in privilege escalation CWE-427 5.3 Medium 2026-06-16
CVE-2026-9669 bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow CWE-121 8.2 High 2026-06-08
CVE-2026-7774 tarfile.data_filter path traversal bypass allows writing outside the extraction directory CWE-22 6.9 Medium 2026-06-04
CVE-2026-3276 Potential DoS via quadratic complexity in unicodedata.normalize() CWE-407 6.3 Medium 2026-06-03
CVE-2026-8328 FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address CWE-918 5.9 Medium 2026-05-13
CVE-2026-7210 The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection CWE-331 6.3 Medium 2026-05-11
CVE-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs CWE-22 6.0 Medium 2026-04-27
CVE-2026-6019 BaseCookie.js_output() does not neutralize embedded characters CWE-150 6.1AI Medium AI 2026-04-22
CVE-2026-3298 Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes CWE-787 8.8 High 2026-04-21

All 80 known CVE vulnerabilities affecting CPython with full Chinese analysis, references, and POCs where available.