Python Software Foundation vulnerabilities
85 CVEs and advisories name Python Software Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-6069HTMLParser quadratic complexity when processing malformed inputs
- CVE-2024-12718Bypass extraction filter to modify file metadata outside extraction directory
- CVE-2025-4435Tarfile extracts filtered members when errorlevel=0
- CVE-2025-4138Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
- CVE-2025-4330Extraction filter bypass for linking outside extraction directory
- CVE-2025-4517Arbitrary writes via tarfile realpath overflow
- CVE-2025-4516Use-after-free in "unicode_escape" decoder with error handler
- CVE-2025-1795Mishandling of comma during folding and unicode-encoding of email headers
- CVE-2024-3220Default mimetype known files writeable on Windows
- CVE-2025-0938URL parser allowed square brackets in domain names
- CVE-2024-12254Unbounded memory buffering in SelectorSocketTransport.writelines()
- CVE-2024-11168Improper validation of IPv6 and IPvFuture addresses
- CVE-2024-9287Virtual environment (venv) activation scripts don't quote paths
- CVE-2024-6232Regular-expression DoS when parsing TarFile headers
- CVE-2024-8088Infinite loop when iterating over zip archive entry names from zipfile.Path
- CVE-2024-7592Quadratic complexity parsing cookies with backslashes
- CVE-2024-6923Email header injection due to unquoted newlines
- CVE-2024-3219Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection
- CVE-2024-5642Buffer overread when using an empty list with SSLContext.set_npn_protocols()
- CVE-2024-0397Memory race condition in ssl.SSLContext certificate store methods
- CVE-2024-4032Incorrect IPv4 and IPv6 private ranges
- CVE-2024-4030tempfile.mkdtemp() may be readable and writeable by all users on Windows
- CVE-2023-6597An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and pri
- CVE-2024-0450Quoted zip-bomb protection for zipfile
- CVE-2023-6507Groups not dropped before running subprocess when using empty 'extra_groups' parameter