Vulnerabilities

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacke…

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requir…

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating sys…

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context.

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete.

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK.

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically…

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic.

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length.

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment…

There is a MEDIUM severity vulnerability affecting CPython.

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module.

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms.

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5.

An issue was discovered in Python 3.11 through 3.11.4.

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1.

An XML External Entity (XXE) issue was discovered in Python through 3.9.1.

read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.

A use-after-free exists in Python through 3.9 via heappushpop in heapq.