Product by Python Software Foundation
Cpython
78 known vulnerabilities in Cpython (Python Software Foundation), 0 of them actively exploited (CISA KEV).
Key figures
78
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-6232 | Regular-expression DoS when parsing TarFile headers | 7.5 | |
| High | CVE-2024-8088 | Infinite loop when iterating over zip archive entry names from zipfile.Path | — | |
| High | CVE-2024-12254 | Unbounded memory buffering in SelectorSocketTransport.writelines() | 7.5 | |
| High | CVE-2025-4138 | Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory | 7.5 | |
| High | CVE-2024-7592 | Quadratic complexity parsing cookies with backslashes | 7.5 | |
| Critical | CVE-2025-4517 | Arbitrary writes via tarfile realpath overflow | 9.4 | |
| Medium | CVE-2025-0938 | URL parser allowed square brackets in domain names | — | |
| High | CVE-2025-13836 | Excessive read buffering DoS in http.client | 7.5 | |
| High | CVE-2026-15308 | Python Software Foundation CPython: Uncontrolled Resource Consumption | 7.5 | |
| Critical | CVE-2026-115557 | Distrust compromised intermediate certificates in ssl module | — | |
| Critical | CVE-2026-19445 | Use-after-free of a server-side SSLContext when sni_callback switches contexts | — | |
| High | CVE-2024-9287 | Virtual environment (venv) activation scripts don't quote paths | 7.8 | |
| High | CVE-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 7.5 | |
| High | CVE-2025-8194 | Tarfile infinite loop during parsing with negative member offset | 7.5 | |
| High | CVE-2026-19553 | SSLContext.wrap_bio() missing validation of server_hostname parameter | — | |
| High | CVE-2026-11972 | tarfile opened in streaming mode mishandles EOF | — | |
| Medium | CVE-2026-7774 | tarfile.data_filter path traversal bypass allows writing outside the extraction directory | — | |
| Medium | CVE-2025-12084 | Quadratic complexity in node ID cache clearing | 5.3 | |
| High | CVE-2026-11940 | tarfile extraction filter bypass allows escaping the destination directory | — | |
| Medium | CVE-2024-6923 | Email header injection due to unquoted newlines | 5.5 | |
| High | CVE-2026-9669 | bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow | — | |
| Critical | CVE-2026-6100 | Python Software Foundation CPython: Use After Free | 8.1 | |
| Medium | CVE-2025-12781 | base64.b64decode() always accepts "+/" characters, despite setting altchars | 5.3 | |
| Medium | CVE-2026-87910 | tarfile hardlink fallback ignores custom extraction filter rejection via None | — | |
| Medium | CVE-2026-17084 | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | — |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 27sans-atrisk-mail,