Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 74

Export CSV
CVE-2026-115559

imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS

IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-16052

Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel

The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-19552

ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity

When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-9669

bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow

bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-8328

FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-6019

BaseCookie.js_output() does not neutralize embedded characters

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython Python
CVE-2026-3276

Potential DoS via quadratic complexity in unicodedata.normalize()

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-1502

HTTP client proxy tunnel headers not validated for CR/LF

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-19553

SSLContext.wrap_bio() missing validation of server_hostname parameter

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-19445

Use-after-free of a server-side SSLContext when sni_callback switches contexts

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Python Redhat
Products
Cpython Hummingbird
CVE-2026-18503

Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-17084

stringprep.map_table_b2() deviates from RFC 3454 Table B.2

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-15806

`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-15310

zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython
CVE-2026-15308

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Python
Products
Cpython Python
CVE-2026-124249

`http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-119170

Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-103995

Lenient parsing of integers for response body and chunk framing

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-115557

Distrust compromised intermediate certificates in ssl module

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-114583

tar filter allows writing outside destination via empty-named symlink

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython