Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CPython — Vulnerabilities & Security Advisories 53

All 53 CVE vulnerabilities found in CPython, with AI-generated Chinese analysis, references, and POCs.

Vendor: Python Software Foundation

CVE IDTitleCVSSSeverityPublished
CVE-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs CWE-22 6.2AIMediumAI2026-04-27
CVE-2026-6019 BaseCookie.js_output() does not neutralize embedded characters CWE-150 6.1AIMediumAI2026-04-22
CVE-2026-3298 Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes CWE-787 8.8AIHighAI2026-04-21
CVE-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target CWE-121 9.1 -2026-04-14
CVE-2026-4786 Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() CWE-77 9.8 -2026-04-13
CVE-2026-6100 Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure CWE-416 8.4 -2026-04-13
CVE-2026-3446 Base64 decoding stops at first padded quad by default 8.2AIHighAI2026-04-10
CVE-2026-1502 HTTP client proxy tunnel headers not validated for CR/LF 7.5AIHighAI2026-04-10
CVE-2026-4519 webbrowser.open() allows leading dashes in URLs 8.2 -2026-03-20
CVE-2026-3479 pkgutil.get_data() does not enforce documented restrictions 7.5 -2026-03-18
CVE-2026-4224 Stack overflow parsing XML with deeply nested DTD content models 9.8 -2026-03-16
CVE-2026-3644 Incomplete control character validation in http.cookies 9.8 -2026-03-16
CVE-2025-13462 tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling 6.5AIMediumAI2026-03-12
CVE-2026-2297 SourcelessFileLoader does not use io.open_code() 8.2 -2026-03-04
CVE-2026-1299 email BytesGenerator header injection due to unquoted newlines CWE-93 4.3 -2026-01-23
CVE-2025-12781 base64.b64decode() always accepts "+/" characters, despite setting altchars 7.5AIHighAI2026-01-21
CVE-2026-0672 Header injection in http.cookies.Morsel CWE-93 4.3AIMediumAI2026-01-20
CVE-2025-15367 POP3 command injection in user-controlled commands CWE-77 9.8AICriticalAI2026-01-20
CVE-2025-15366 IMAP command injection in user-controlled commands CWE-77 9.8AICriticalAI2026-01-20
CVE-2025-15282 Header injection via newlines in data URL mediatype CWE-93 5.3AIMediumAI2026-01-20
CVE-2026-0865 wsgiref.headers.Headers allows header newline injection CWE-74 4.7AIMediumAI2026-01-20
CVE-2025-11468 Folding email comments of unfoldable characters doesn't preserve parenthesis 6.5AIMediumAI2026-01-20
CVE-2025-12084 Quadratic complexity in node ID cache clearing 7.5AIHighAI2025-12-03
CVE-2025-13837 Out-of-memory when loading Plist 6.5AIMediumAI2025-12-01
CVE-2025-13836 Excessive read buffering DoS in http.client 9.8AICriticalAI2025-12-01
CVE-2025-6075 Quadratic complexity in os.path.expandvars() with user-controlled template 7.5 -2025-10-31
CVE-2025-8291 ZIP64 End of Central Directory (EOCD) Locator record offset not checked 4.3 Medium2025-10-07
CVE-2025-8194 Tarfile infinite loop during parsing with negative member offset CWE-835 7.5 High2025-07-28
CVE-2025-6069 HTMLParser quadratic complexity when processing malformed inputs CWE-1333 4.3 Medium2025-06-17
CVE-2024-12718 Bypass extraction filter to modify file metadata outside extraction directory CWE-22 5.3 Medium2025-06-03

All 53 known CVE vulnerabilities affecting CPython with full Chinese analysis, references, and POCs where available.