Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 387

Export CSV
CVE-2019-10160

python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

CVSS 3.1 · 9.8 Critical EPSS 5.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 13 more
CVE-2016-3189

bzip2: heap use after free in bzip2recover

Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.

CVSS 3.1 · 6.5 Medium EPSS 15.7% KEV · Not listed
Vendors
Bzip Python
Products
Bzip2 Python
CVE-2015-20107

python: mailcap: findmatch() function does not sanitize the second argument

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

CVSS 3.1 · 7.8 High EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Netapp Python and 1 more
Products
Fedora Active Iq Unified Manager Ontap Select Deploy Administration Utility and 4 more
CVE-2013-0340

expat: internal entity expansion

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

CVSS 2.0 · 6.8 Medium EPSS 19.4% KEV · Not listed
Vendors
Apple Libexpat Project Python
Products
Ipados Iphone Os Macos and 4 more
CVE-2026-97687

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Python Urllib3
Products
Urllib3 Urllib3
CVE-2026-97688

urllib3: Chunked Deflate streaming can enter an infinite loop

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Python Urllib3
Products
Urllib3 Urllib3
CVE-2026-97689

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Python Urllib3
Products
Urllib3 Urllib3
CVE-2026-82049

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2021-29921

python-ipaddress: Improper input validation of octal strings

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

CVSS 3.1 · 9.8 Critical EPSS 6.8% KEV · Not listed
Vendors
Oracle Python Redhat
Products
Communications Cloud Native Core Automated Test Suite Communications Cloud Native Core Binding Support Function Communications Cloud Native Core Network Slice Selection Function and 5 more
CVE-2018-1060

python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

CVSS 3.1 · 7.5 High EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2018-1000802

python: Command injection in the shutil module

Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

CVSS 3.1 · 9.8 Critical EPSS 20.1% KEV · Not listed
Vendors
Canonical Debian Opensuse and 1 more
Products
Ubuntu Linux Debian Linux Leap and 1 more
CVE-2018-1000030

python: Heap-Buffer-Overflow and Heap-Use-After-Free in Objects/fileobject.c

Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.

CVSS 3.1 · 3.6 Low EPSS 1.2% KEV · Not listed
Vendors
Canonical Python
Products
Ubuntu Linux Python
CVE-2017-9233

expat: Inifinite loop due to invalid XML in external entity

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

CVSS 3.1 · 7.5 High EPSS 8.7% KEV · Not listed
Vendors
Debian Libexpat Project Python
Products
Debian Linux Libexpat Python
CVE-2017-1000158

python: Integer overflow in PyString_DecodeEscape results in heap-base buffer overflow

CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)

CVSS 3.1 · 9.8 Critical EPSS 7.9% KEV · Not listed
Vendors
Debian Python
Products
Debian Linux Python
CVE-2016-9063

firefox: Possible integer overflow to fix inside XML_Parse in Expat

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.

CVSS 3.1 · 9.8 Critical EPSS 5.4% KEV · Not listed
Vendors
Debian Mozilla Python
Products
Debian Linux Firefox Python
CVE-2016-4472

expat: Undefined behavior and pointer overflows

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.

CVSS 3.1 · 8.1 High EPSS 11.9% KEV · Not listed
Vendors
Canonical Libexpat Project Mcafee and 1 more
Products
Ubuntu Linux Libexpat Policy Auditor and 1 more
CVE-2016-0718

expat: Out-of-bounds heap read on crafted input causing crash

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

CVSS 3.1 · 9.8 Critical EPSS 13.3% KEV · Not listed
Vendors
Apple Canonical Debian and 7 more
Products
Mac Os X Ubuntu Linux Debian Linux and 13 more
CVE-2019-5010

python: NULL pointer dereference using a specially crafted X509 certificate

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 20.7% KEV · Not listed
Vendors
Debian Opensuse Python and 1 more
Products
Debian Linux Leap Python and 6 more
CVE-2019-16935

python: XSS vulnerability in the documentation XML-RPC server in server_title field

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

CVSS 3.1 · 6.1 Medium EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Python and 1 more
Products
Ubuntu Linux Debian Linux Python and 3 more