REDHAT-BUG-2366509: Medium severity pypi/cpython vulnerability

Published May 15, 2025

Updated

There is an issue in CPython when using bytes.decode("unicodeescape", error="ignore|replace"). If you are not using the "unicodeescape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

Affected Software

1 affected component

pypi/cpython

Event History

May 15, 2025

Data Sourced

via Red Hat·02:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2366509?

The severity of REDHAT-BUG-2366509 is considered high due to potential data loss or application crashes.

How do I fix REDHAT-BUG-2366509?

To fix REDHAT-BUG-2366509, avoid using the 'unicode_escape' encoding or error handlers with bytes.decode().

What versions of CPython are affected by REDHAT-BUG-2366509?

REDHAT-BUG-2366509 affects all versions of CPython that utilize the 'unicode_escape' encoding with error handlers.

Is there a workaround for REDHAT-BUG-2366509?

Yes, a workaround for REDHAT-BUG-2366509 involves using bytes.decode() without the error handler.

Who is impacted by REDHAT-BUG-2366509?

Developers and applications that depend on CPython's bytes.decode with 'unicode_escape' are impacted by REDHAT-BUG-2366509.