Python Software Foundation vulnerabilities
85 CVEs and advisories name Python Software Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-7210The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
- CVE-2026-3087shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
- CVE-2026-6019BaseCookie.js_output() does not neutralize embedded characters
- CVE-2026-3298Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
- CVE-2026-5713Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target
- CVE-2026-4786Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
- CVE-2026-6100Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
- CVE-2026-3446Base64 decoding stops at first padded quad by default
- CVE-2026-1502HTTP client proxy tunnel headers not validated for CR/LF
- CVE-2026-5271Possible to hijack modules in current working directory
- CVE-2026-4519webbrowser.open() allows leading dashes in URLs
- CVE-2026-3479pkgutil.get_data() does not enforce documented restrictions
- CVE-2026-4224Stack overflow parsing XML with deeply nested DTD content models
- CVE-2026-3644Incomplete control character validation in http.cookies
- CVE-2025-13462tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling
- CVE-2026-2297SourcelessFileLoader does not use io.open_code()
- CVE-2026-1299email BytesGenerator header injection due to unquoted newlines
- CVE-2025-12781base64.b64decode() always accepts "+/" characters, despite setting altchars
- CVE-2026-0672Header injection in http.cookies.Morsel
- CVE-2025-15367POP3 command injection in user-controlled commands
- CVE-2025-15366IMAP command injection in user-controlled commands
- CVE-2025-15282Header injection via newlines in data URL mediatype
- CVE-2026-0865wsgiref.headers.Headers allows header newline injection
- CVE-2025-11468Folding email comments of unfoldable characters doesn't preserve parenthesis
- CVE-2025-12084Quadratic complexity in node ID cache clearing
- CVE-2025-13837Out-of-memory when loading Plist
- CVE-2025-13836Excessive read buffering DoS in http.client
- CVE-2025-6075Quadratic complexity in os.path.expandvars() with user-controlled template
- CVE-2025-8291ZIP64 End of Central Directory (EOCD) Locator record offset not checked
- CVE-2025-8194Tarfile infinite loop during parsing with negative member offset