There is an issue in CPython when using bytes.decode("unicodeescape", error="ignore|replace"). If you are not using the "unicodeescape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.setnpnprotocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.setnpnprotocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).
https://github.com/python/cpython/commit/39258d3595300bc7b952854c915f63ae2d4b9c3e https://github.com/python/cpython/pull/23014 https://jbp.io/2024/06/27/cve-2024-5535-openssl-memory-safety.html https://mail.python.org/archives/list/security-announce@python.org/thread/PLP2JI3PJY33YG6P5BZYSSNU66HASXBQ/
Quadratic complexity in node ID cache clearing
-------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-3644] Incomplete control character validation in http.cookies Date: Mon, 16 Mar 2026 17:28:35 +0000 From: Stan Ulbrych via Security-announce <security-announce () python org> Reply-To: security-sig () python org To: security-announce () python org CC: Stan Ulbrych <stanulbrych () gmail com>
There is a MEDIUM severity vulnerability affecting CPython.
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.jsoutput() lacked the output validation applied to BaseCookie.output().
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2026-3644 https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4
-- Best regards, Stan Ulbrych. Security-announce mailing list -- security-announce () python org To unsubscribe send an email to security-announce-leave () python org https://mail.python.org/mailman3//lists/security-announce.python.org
-------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-4224] Stack overflow parsing XML with deeply nested DTD content models Date: Mon, 16 Mar 2026 17:46:00 +0000 From: Stan Ulbrych via Security-announce <security-announce () python org> Reply-To: security-sig () python org To: security-announce () python org CC: Stan Ulbrych <stanulbrych () gmail com>
There is a HIGH severity vulnerability affecting CPython.
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2026-4224 https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768
-------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-2297] SourcelessFileLoader does not use io.opencode() Date: Wed, 4 Mar 2026 22:42:49 +0000 From: Seth Larson <seth () python org> Reply-To: security-sig () python org To: security-announce () python org
There is a MEDIUM severity vulnerability affecting CPython.
The import hook in CPython that handles legacy .pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.opencode() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2026-2297
https://github.com/python/cpython/pull/145507
https://mail.python.org/archives/list/security-announce () python org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/ announces: [CVE-2025-11468] Folding email comments of unfoldable characters doesn't preserve parenthesis
There is a MEDIUM severity vulnerability affecting CPython.
When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2025-11468 https://github.com/python/cpython/pull/143936 https://www.cve.org/CVERecord?id=CVE-2025-11468 lists affected versions as "affected from 0 before 3.15.0"
------------------------------------------------------------------------
https://mail.python.org/archives/list/security-announce () python org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/ announces: [CVE-2025-15366] IMAP command injection in user-controlled commands
There is a MEDIUM severity vulnerability affecting CPython.
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2025-15366 https://github.com/python/cpython/pull/143922 https://www.cve.org/CVERecord?id=CVE-2025-15366 lists affected versions as "affected from 0 before 3.15.0"
------------------------------------------------------------------------
https://mail.python.org/archives/list/security-announce () python org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/ announces: [CVE-2025-15367] POP3 command injection in user-controlled commands
There is a MEDIUM severity vulnerability affecting CPython.
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2025-15367 https://github.com/python/cpython/pull/143924 https://www.cve.org/CVERecord?id=CVE-2025-15367 lists affected versions as "affected from 0 before 3.15.0"
------------------------------------------------------------------------
https://mail.python.org/archives/list/security-announce () python org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/ announces: [CVE-2025-15282] Header injection via newlines in data URL mediatype
There is a MEDIUM severity vulnerability affecting CPython.
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2025-15282 https://github.com/python/cpython/pull/143926 https://www.cve.org/CVERecord?id=CVE-2025-15282 lists affected versions as "affected from 0 before 3.15.0"
------------------------------------------------------------------------
https://mail.python.org/archives/list/security-announce () python org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/ announces: [CVE-2026-0672] Header injection in http.cookies.Morsel
There is a MEDIUM severity vulnerability affecting CPython.
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2026-0672 https://github.com/python/cpython/pull/143920 https://www.cve.org/CVERecord?id=CVE-2026-0672 lists affected versions as "affected from 0 before 3.15.0"
------------------------------------------------------------------------
https://mail.python.org/archives/list/security-announce () python org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/ announces: [CVE-2026-1299] email BytesGenerator header injection due to unquoted newlines
There is a MEDIUM severity vulnerability affecting CPython.
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" while writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2026-1299 https://github.com/python/cpython/pull/144126 https://www.cve.org/CVERecord?id=CVE-2026-1299 lists affected versions as "affected from 0 before 3.15.0"
------------------------------------------------------------------------
https://mail.python.org/archives/list/security-announce () python org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/ announces: [CVE-2026-0865] wsgiref.headers.Headers allows header newline injection
There is a MEDIUM severity vulnerability affecting CPython.
User-controlled header names and values containing newlines can allow injecting HTTP headers.
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2026-0865 https://github.com/python/cpython/pull/143917 https://www.cve.org/CVERecord?id=CVE-2026-0865 lists affected versions as "affected from 0 before 3.15.0"
------------------------------------------------------------------------
https://mail.python.org/archives/list/security-announce () python org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/ announces: [CVE-2025-12781] base64.b64decode() always accepts "+/" characters, despite setting altchars
There is a MEDIUM severity vulnerability affecting CPython.
When passing data to the b64decode(), standardb64decode(), and urlsafeb64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.
This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafeb64decode() function, then your application does not use an alternative base64 alphabet.
The attached patches DO NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars.
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2025-12781 https://github.com/python/cpython/pull/141128 https://www.cve.org/CVERecord?id=CVE-2025-12781 lists affected versions as "affected from 0 before 3.13.10" "affected from 3.14.0 before 3.14.1" "affected from 3.15.0a1 before 3.15.0a2"
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
There is an issue in CPython when using bytes.decode("unicodeescape", error="ignore|replace"). If you are not using the "unicodeescape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.
-------- Forwarded Message -------- Subject: [Security-announce][CVE-2025-13836] Excessive read buffering DoS in http.client Date: Mon, 1 Dec 2025 18:57:32 +0000 From: Seth Larson <seth () python org> Reply-To: security-sig () python org To: security-announce () python org
There is a MEDIUM severity vulnerability affecting CPython.
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2025-13836 https://github.com/python/cpython/pull/119454
-------- Forwarded Message -------- Subject: [Security-announce][CVE-2025-13837] Out-of-memory when loading Plist Date: Mon, 1 Dec 2025 18:58:33 +0000 From: Seth Larson <seth () python org> Reply-To: security-sig () python org To: security-announce () python org
There is a LOW severity vulnerability affecting CPython.
When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2025-13837 https://github.com/python/cpython/pull/119343
-------- Forwarded Message -------- Subject: [Security-announce][CVE-2025-12084] Quadratic complexity in node ID cache clearing Date: Wed, 3 Dec 2025 18:59:03 +0000 From: Seth Larson <seth () python org> Reply-To: security-sig () python org To: security-announce () python org
There is a MEDIUM severity vulnerability affecting CPython.
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on clearidcache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2025-12084 https://github.com/python/cpython/pull/142146