Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

CPython — Vulnerabilities & Security Advisories 72

All 72 CVE vulnerabilities found in CPython, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability reports specifically for the CPython product within the CPython vendor. It collects historical security disclosures covering various weakness types, spanning the full documented history of the implementation. Readers can use this page to track the vendor's security advisories, understand recurring weakness classes, and review the specific product's vulnerability history without navigating individual database entries. The collection excludes specific CVE IDs in this introduction, focusing instead on the structural relationships between the vendor, product, and flaw categories. This aggregation facilitates a high-level overview of security trends and patch patterns.

Vendor: Python Software Foundation

CVE ID Title CVSS Severity Published
CVE-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink CWE-59 8.4 High 2026-09-14
CVE-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None CWE-22 5.7 Medium 2026-09-11
CVE-2026-15310 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits CWE-400 2.1 Low 2026-08-25
CVE-2026-19672 tarfile extraction filter bypass allows creation of directories outside the destination 6.3 Medium 2026-08-19
CVE-2026-15806 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CWE-319 6.0 Medium 2026-08-18
CVE-2026-17084 stringprep.map_table_b2() deviates from RFC 3454 Table B.2 6.0 Medium 2026-08-18
CVE-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() CWE-1176 2.4 Low 2026-08-10
CVE-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates 2.0 Low 2026-07-28
CVE-2026-15308 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations CWE-400 8.7 High 2026-07-09
CVE-2026-4360 Tarfile.extract() doesn't fully respect filter parameter CWE-281 2.0 Low 2026-06-30
CVE-2026-11972 tarfile opened in streaming mode mishandles EOF CWE-252 8.2 High 2026-06-23
CVE-2026-0864 Configuration Injection via Carriage Return (\r) in write() method 4.1 Medium 2026-06-23
CVE-2026-11940 tarfile extraction filter bypass allows escaping the destination directory CWE-22 7.8 High 2026-06-23
CVE-2026-12003 CPython >3.11 Insecure Input Validation resulting in privilege escalation CWE-427 5.3 Medium 2026-06-16
CVE-2026-9669 bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow CWE-121 8.2 High 2026-06-08
CVE-2026-7774 tarfile.data_filter path traversal bypass allows writing outside the extraction directory CWE-22 6.9 Medium 2026-06-04
CVE-2026-3276 Potential DoS via quadratic complexity in unicodedata.normalize() CWE-407 6.3 Medium 2026-06-03
CVE-2026-8328 FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address CWE-918 5.9 Medium 2026-05-13
CVE-2026-7210 The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection CWE-331 6.3 Medium 2026-05-11
CVE-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs CWE-22 6.0 Medium 2026-04-27
CVE-2026-6019 BaseCookie.js_output() does not neutralize embedded characters CWE-150 6.1AI Medium AI 2026-04-22
CVE-2026-3298 Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes CWE-787 8.8 High 2026-04-21
CVE-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target CWE-121 5.3 Medium 2026-04-14
CVE-2026-4786 Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() CWE-77 7.0 High 2026-04-13
CVE-2026-6100 Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure CWE-416 9.1 Critical 2026-04-13
CVE-2026-3446 Base64 decoding stops at first padded quad by default 8.2AI High AI 2026-04-10
CVE-2026-1502 HTTP client proxy tunnel headers not validated for CR/LF 5.7 Medium 2026-04-10
CVE-2026-4519 webbrowser.open() allows leading dashes in URLs 7.0 High 2026-03-20
CVE-2026-3479 pkgutil.get_data() does not enforce documented restrictions 7.5 - 2026-03-18
CVE-2026-4224 Stack overflow parsing XML with deeply nested DTD content models 6.0 Medium 2026-03-16

All 72 known CVE vulnerabilities affecting CPython with full Chinese analysis, references, and POCs where available.