# cve.now: Python Software Foundation

The newest entries naming Python Software Foundation as an affected vendor (up to 200), of 85 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115559](https://cve.now/CVE-2026-115559.md): imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS (CVSS 6.3)
- [CVE-2026-115791](https://cve.now/CVE-2026-115791.md): Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction (CVSS 5.3)
- [CVE-2026-124249](https://cve.now/CVE-2026-124249.md): \`http.cookiejar\` applies expired \`Set-Cookie\` to cookie store before policy validation (CVSS 6.3)
- [CVE-2026-19552](https://cve.now/CVE-2026-19552.md): ssl.get\_server\_certificate(addr, ca\_certs=...) verifies the chain but never the identity (CVSS 0.0)
- [CVE-2026-119170](https://cve.now/CVE-2026-119170.md): Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10 (CVSS 8.2)
- [CVE-2026-116566](https://cve.now/CVE-2026-116566.md): socket.getaddrinfo() accepts embedded null bytes in host and port (CVSS 5.3)
- [CVE-2026-103995](https://cve.now/CVE-2026-103995.md): Lenient parsing of integers for response body and chunk framing (CVSS 2.0)
- [CVE-2026-115557](https://cve.now/CVE-2026-115557.md): Distrust compromised intermediate certificates in ssl module (CVSS 9.4)
- [CVE-2026-114583](https://cve.now/CVE-2026-114583.md): tar filter allows writing outside destination via empty-named symlink (CVSS 6.9)
- [CVE-2026-19553](https://cve.now/CVE-2026-19553.md): SSLContext.wrap\_bio() missing validation of server\_hostname parameter (CVSS 7.6)
- [CVE-2026-19445](https://cve.now/CVE-2026-19445.md): Use-after-free of a server-side SSLContext when sni\_callback switches contexts (CVSS 9.2)
- [CVE-2026-12345](https://cve.now/CVE-2026-12345.md): Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory (CVSS 5.9)
- [CVE-2026-82049](https://cve.now/CVE-2026-82049.md): tarfile extraction filters allow file modification and content disclosure via hard link to symlink (CVSS 8.4)
- [CVE-2026-87910](https://cve.now/CVE-2026-87910.md): tarfile hardlink fallback ignores custom extraction filter rejection via None (CVSS 5.7)
- [CVE-2026-15310](https://cve.now/CVE-2026-15310.md): zipfile: bzip2/LZMA/Zstandard members decompress without a max\_length bound, defeating chunked-read memory limits (CVSS 2.1)
- [CVE-2026-19672](https://cve.now/CVE-2026-19672.md): tarfile extraction filter bypass allows creation of directories outside the destination (CVSS 6.3)
- [CVE-2026-15806](https://cve.now/CVE-2026-15806.md): \`HTTPPasswordMgr\` can send saved HTTPS credentials via HTTP because of incorrect scheme matching (CVSS 6.0)
- [CVE-2026-17084](https://cve.now/CVE-2026-17084.md): stringprep.map\_table\_b2() deviates from RFC 3454 Table B.2 (CVSS 6.0)
- [CVE-2026-18503](https://cve.now/CVE-2026-18503.md): Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() (CVSS 2.4)
- [CVE-2026-6879](https://cve.now/CVE-2026-6879.md): Quadratic Behavior in xml.etree.ElementPath Index Predicates (CVSS 2.0)
- [CVE-2026-15308](https://cve.now/CVE-2026-15308.md): Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations (CVSS 8.7)
- [CVE-2026-4360](https://cve.now/CVE-2026-4360.md): Tarfile.extract() doesn't fully respect filter parameter (CVSS 2.0)
- [CVE-2026-11972](https://cve.now/CVE-2026-11972.md): tarfile opened in streaming mode mishandles EOF (CVSS 8.2)
- [CVE-2026-0864](https://cve.now/CVE-2026-0864.md): Configuration Injection via Carriage Return (\\r) in write() method (CVSS 4.1)
- [CVE-2026-11940](https://cve.now/CVE-2026-11940.md): tarfile extraction filter bypass allows escaping the destination directory (CVSS 7.8)
- [CVE-2026-12003](https://cve.now/CVE-2026-12003.md): CPython \>3.11 Insecure Input Validation resulting in privilege escalation (CVSS 5.3)
- [CVE-2026-9669](https://cve.now/CVE-2026-9669.md): bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow (CVSS 8.2)
- [CVE-2026-7774](https://cve.now/CVE-2026-7774.md): tarfile.data\_filter path traversal bypass allows writing outside the extraction directory (CVSS 6.9)
- [CVE-2026-3276](https://cve.now/CVE-2026-3276.md): Potential DoS via quadratic complexity in unicodedata.normalize() (CVSS 6.3)
- [CVE-2026-8328](https://cve.now/CVE-2026-8328.md): FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address (CVSS 5.9)
- [CVE-2026-7210](https://cve.now/CVE-2026-7210.md): The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection (CVSS 6.3)
- [CVE-2026-3087](https://cve.now/CVE-2026-3087.md): shutil.unpack\_archive() doesn't check for Windows absolute paths in ZIPs (CVSS 6.0)
- [CVE-2026-6019](https://cve.now/CVE-2026-6019.md): BaseCookie.js\_output() does not neutralize embedded characters (CVSS 2.1)
- [CVE-2026-3298](https://cve.now/CVE-2026-3298.md): Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock\_recvfrom\_into() when using nbytes (CVSS 8.8)
- [CVE-2026-5713](https://cve.now/CVE-2026-5713.md): Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target (CVSS 5.3)
- [CVE-2026-4786](https://cve.now/CVE-2026-4786.md): Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() (CVSS 7.0)
- [CVE-2026-6100](https://cve.now/CVE-2026-6100.md): Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure (CVSS 9.1)
- [CVE-2026-3446](https://cve.now/CVE-2026-3446.md): Base64 decoding stops at first padded quad by default (CVSS 6.0)
- [CVE-2026-1502](https://cve.now/CVE-2026-1502.md): HTTP client proxy tunnel headers not validated for CR/LF (CVSS 5.7)
- [CVE-2026-5271](https://cve.now/CVE-2026-5271.md): Possible to hijack modules in current working directory (CVSS 5.6)
- [CVE-2026-4519](https://cve.now/CVE-2026-4519.md): webbrowser.open() allows leading dashes in URLs (CVSS 7.0)
- [CVE-2026-3479](https://cve.now/CVE-2026-3479.md): pkgutil.get\_data() does not enforce documented restrictions (CVSS 0.0)
- [CVE-2026-4224](https://cve.now/CVE-2026-4224.md): Stack overflow parsing XML with deeply nested DTD content models (CVSS 6.0)
- [CVE-2026-3644](https://cve.now/CVE-2026-3644.md): Incomplete control character validation in http.cookies (CVSS 6.0)
- [CVE-2025-13462](https://cve.now/CVE-2025-13462.md): tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling (CVSS 2.0)
- [CVE-2026-2297](https://cve.now/CVE-2026-2297.md): SourcelessFileLoader does not use io.open\_code() (CVSS 5.7)
- [CVE-2026-1299](https://cve.now/CVE-2026-1299.md): email BytesGenerator header injection due to unquoted newlines (CVSS 6.0)
- [CVE-2025-12781](https://cve.now/CVE-2025-12781.md): base64.b64decode() always accepts "+/" characters, despite setting altchars (CVSS 6.3)
- [CVE-2026-0672](https://cve.now/CVE-2026-0672.md): Header injection in http.cookies.Morsel (CVSS 6.0)
- [CVE-2025-15367](https://cve.now/CVE-2025-15367.md): POP3 command injection in user-controlled commands (CVSS 5.9)
- [CVE-2025-15366](https://cve.now/CVE-2025-15366.md): IMAP command injection in user-controlled commands (CVSS 5.9)
- [CVE-2025-15282](https://cve.now/CVE-2025-15282.md): Header injection via newlines in data URL mediatype (CVSS 6.0)
- [CVE-2026-0865](https://cve.now/CVE-2026-0865.md): wsgiref.headers.Headers allows header newline injection (CVSS 5.9)
- [CVE-2025-11468](https://cve.now/CVE-2025-11468.md): Folding email comments of unfoldable characters doesn't preserve parenthesis (CVSS 5.7)
- [CVE-2025-12084](https://cve.now/CVE-2025-12084.md): Quadratic complexity in node ID cache clearing (CVSS 6.3)
- [CVE-2025-13837](https://cve.now/CVE-2025-13837.md): Out-of-memory when loading Plist (CVSS 2.1)
- [CVE-2025-13836](https://cve.now/CVE-2025-13836.md): Excessive read buffering DoS in http.client (CVSS 6.3)
- [CVE-2025-6075](https://cve.now/CVE-2025-6075.md): Quadratic complexity in os.path.expandvars() with user-controlled template (CVSS 1.8)
- [CVE-2025-8291](https://cve.now/CVE-2025-8291.md): ZIP64 End of Central Directory (EOCD) Locator record offset not checked (CVSS 4.3)
- [CVE-2025-8194](https://cve.now/CVE-2025-8194.md): Tarfile infinite loop during parsing with negative member offset (CVSS 7.5)
- [CVE-2025-6069](https://cve.now/CVE-2025-6069.md): HTMLParser quadratic complexity when processing malformed inputs (CVSS 4.3)
- [CVE-2024-12718](https://cve.now/CVE-2024-12718.md): Bypass extraction filter to modify file metadata outside extraction directory (CVSS 5.3)
- [CVE-2025-4435](https://cve.now/CVE-2025-4435.md): Tarfile extracts filtered members when errorlevel=0 (CVSS 7.5)
- [CVE-2025-4138](https://cve.now/CVE-2025-4138.md): Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVSS 7.5)
- [CVE-2025-4330](https://cve.now/CVE-2025-4330.md): Extraction filter bypass for linking outside extraction directory (CVSS 7.5)
- [CVE-2025-4517](https://cve.now/CVE-2025-4517.md): Arbitrary writes via tarfile realpath overflow (CVSS 9.4)
- [CVE-2025-4516](https://cve.now/CVE-2025-4516.md): Use-after-free in "unicode\_escape" decoder with error handler (CVSS 5.9)
- [CVE-2025-1795](https://cve.now/CVE-2025-1795.md): Mishandling of comma during folding and unicode-encoding of email headers (CVSS 2.3)
- [CVE-2024-3220](https://cve.now/CVE-2024-3220.md): Default mimetype known files writeable on Windows (CVSS 2.3)
- [CVE-2025-0938](https://cve.now/CVE-2025-0938.md): URL parser allowed square brackets in domain names (CVSS 6.3)
- [CVE-2024-12254](https://cve.now/CVE-2024-12254.md): Unbounded memory buffering in SelectorSocketTransport.writelines() (CVSS 8.7)
- [CVE-2024-11168](https://cve.now/CVE-2024-11168.md): Improper validation of IPv6 and IPvFuture addresses (CVSS 6.3)
- [CVE-2024-9287](https://cve.now/CVE-2024-9287.md): Virtual environment (venv) activation scripts don't quote paths (CVSS 5.3)
- [CVE-2024-6232](https://cve.now/CVE-2024-6232.md): Regular-expression DoS when parsing TarFile headers (CVSS 7.5)
- [CVE-2024-8088](https://cve.now/CVE-2024-8088.md): Infinite loop when iterating over zip archive entry names from zipfile.Path (CVSS 8.7)
- [CVE-2024-7592](https://cve.now/CVE-2024-7592.md): Quadratic complexity parsing cookies with backslashes (CVSS 7.5)
- [CVE-2024-6923](https://cve.now/CVE-2024-6923.md): Email header injection due to unquoted newlines (CVSS 5.5)
- [CVE-2024-3219](https://cve.now/CVE-2024-3219.md): Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection (CVSS 5.1)
- [CVE-2024-5642](https://cve.now/CVE-2024-5642.md): Buffer overread when using an empty list with SSLContext.set\_npn\_protocols() (CVSS 6.5)
- [CVE-2024-0397](https://cve.now/CVE-2024-0397.md): Memory race condition in ssl.SSLContext certificate store methods (CVSS 7.4)
- [CVE-2024-4032](https://cve.now/CVE-2024-4032.md): Incorrect IPv4 and IPv6 private ranges (CVSS 7.5)
- [CVE-2024-4030](https://cve.now/CVE-2024-4030.md): tempfile.mkdtemp() may be readable and writeable by all users on Windows (CVSS 7.1)
- [CVE-2023-6597](https://cve.now/CVE-2023-6597.md): An issue was found in the CPython \`tempfile.TemporaryDirectory\` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and pri (CVSS 7.8)
- [CVE-2024-0450](https://cve.now/CVE-2024-0450.md): Quoted zip-bomb protection for zipfile (CVSS 6.2)
- [CVE-2023-6507](https://cve.now/CVE-2023-6507.md): Groups not dropped before running subprocess when using empty 'extra\_groups' parameter (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/python-software-foundation
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.