https://seclists.org/oss-sec/2026/q2/521: [oss-security][CVE-2026-8328] CPython: FTP PASV SSRF, ftpcp() does not use actual peer addss, trusts server-supplied PASV host addss
Published May 14, 2026
·Updated
Affected Software
1 affected component
Python CPython
Frequently Asked Questions
1
What is the severity of CVE-2026-8328?
CVE-2026-8328 has a MEDIUM severity level.
2
How does CVE-2026-8328 affect CPython?
CVE-2026-8328 allows for a potential Server-Side Request Forgery (SSRF) through the FTP PASV command.
3
What versions of CPython are impacted by CVE-2026-8328?
The specific affected versions of CPython are not listed but typically include the most recent and preceding releases at the time of the vulnerability announcement.
4
How can I fix CVE-2026-8328?
To mitigate CVE-2026-8328, update to a patched version of CPython as recommended by the Python security team.
5
Are there any workarounds for CVE-2026-8328?
As of now, there are no formal workarounds proposed for CVE-2026-8328, so applying the update is the best option.