Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 74

Export CSV
CVE-2025-15367

POP3 command injection in user-controlled commands

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2025-15282

Header injection via newlines in data URL mediatype

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2025-11468

Folding email comments of unfoldable characters doesn't preserve parenthesis

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2024-6923

Email header injection due to unquoted newlines

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Python Redhat
Products
Cpython Enterprise Linux Rhel Aus and 4 more
CVE-2024-4032

Incorrect IPv4 and IPv6 private ranges

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Python Redhat
Products
Cpython Enterprise Linux Rhel Aus and 3 more
CVE-2024-4030

tempfile.mkdtemp() may be readable and writeable by all users on Windows

On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-3479

pkgutil.get_data() does not enforce documented restrictions

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2025-13837

Out-of-memory when loading Plist

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython Python
CVE-2025-6075

Quadratic complexity in os.path.expandvars() with user-controlled template

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Python Cpython
CVE-2025-13836

Excessive read buffering DoS in http.client

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

CVSS 4.0 · 6.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Python
Products
Cpython Python
CVE-2025-12084

Quadratic complexity in node ID cache clearing

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython Python
CVE-2025-12781

base64.b64decode() always accepts "+/" characters, despite setting altchars

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython Python
CVE-2024-7592

Quadratic complexity parsing cookies with backslashes

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Python Redhat
Products
Cpython Python Enterprise Linux
CVE-2024-6232

Regular-expression DoS when parsing TarFile headers

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Python Redhat
Products
Cpython Python Enterprise Linux and 5 more