Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16

Export CSV
CVE-2026-115559

imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS

IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-16052

Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel

The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-19552

ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity

When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-124249

`http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-119170

Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-103995

Lenient parsing of integers for response body and chunk framing

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-115557

Distrust compromised intermediate certificates in ssl module

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-114583

tar filter allows writing outside destination via empty-named symlink

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2026-116566

socket.getaddrinfo() accepts embedded null bytes in host and port

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Cpython
CVE-2024-0397

Memory race condition in ssl.SSLContext certificate store methods

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Python Software Foundation Redhat
Products
Cpython Enterprise Linux
CVE-2023-6597

python: Path traversal on tempfile.TemporaryDirectory

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Python Software Foundation Redhat
Products
Cpython Enterprise Linux Openshift and 5 more
CVE-2024-8088

Infinite loop when iterating over zip archive entry names from zipfile.Path

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

CVSS 4.0 · 8.7 High EPSS 1.3% KEV · Not listed
Vendors
Python Software Foundation Redhat
Products
Cpython Enterprise Linux
CVE-2024-3219

Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection

The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create a local connected pair of sockets. The connection between the two sockets was not verified before passing the two sockets back to the user, which leaves the server socket vulnerable to a connection race from a malicious local peer. Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Python Software Foundation
Products
Cpython
CVE-2024-12254

Unbounded memory buffering in SelectorSocketTransport.writelines()

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

CVSS 4.0 · 8.7 High EPSS 1.9% KEV · Not listed
Vendors
Python Software Foundation Redhat
Products
Cpython Enterprise Linux Rhel Eus
CVE-2024-11168

Improper validation of IPv6 and IPvFuture addresses

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Python Software Foundation Redhat
Products
Cpython Enterprise Linux
CVE-2025-6075

Quadratic complexity in os.path.expandvars() with user-controlled template

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed
Vendors
Python Python Software Foundation
Products
Cpython Python Cpython