Most severe vulnerabilities for "python python" 3.15.0-alpha3

Where

AND

Sort:

Python html.parser.HTMLParserIncremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Risk 50

Severity

8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

First published (updated )

CVE-2026-15308

Python Software Foundation CPythonwebbrowser.open() allows leading dashes in URLs

Risk 47

Severity

EPSS

0.03%

Input Validation

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Last updated 6 July 2026

1 / 5

Source: Ubuntu

First published (updated )

CVE-2026-4519

Python Software Foundation CPythonThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

Risk 32

Severity

6.3

EPSS

0.06%

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-7210

Python CPythonIncomplete control character validation in http.cookies

Risk 32

Severity

EPSS

0.11%

Input Validation

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Incomplete control character validation in http.cookies

1 / 3

Source: Microsoft

First published (updated )

CVE-2026-3644

Python CPythonStack overflow parsing XML with deeply nested DTD content models

Risk 32

Severity

EPSS

0.03%

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Last updated 6 July 2026

1 / 4

Source: Ubuntu

First published (updated )

CVE-2026-4224

Python Python (shutil.unpack_archive)shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

Risk 46

Severity

Path Traversal

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

If shutil.unpackarchive() is given a ZIP archive with an absolute Windows path containing a drive (C:\\...) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-3087

Python configparserConfiguration Injection via Carriage Return (\r) in write() method

Risk 32

Severity

4.1

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Configuration Injection via Carriage Return (\r) in write() method

1 / 2

Source: Microsoft

First published (updated )

CVE-2026-0864

pypi/tarfiletarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

Risk 18

Severity

Input Validation, Malicious File Upload

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

1 / 2

Source: Microsoft

First published (updated )

CVE-2025-13462

Trending

Python html.parser.HTMLParserIncremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Python Software Foundation CPythonwebbrowser.open() allows leading dashes in URLs

Python Software Foundation CPythonThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

Python CPythonIncomplete control character validation in http.cookies

Python CPythonStack overflow parsing XML with deeply nested DTD content models

Python Python (shutil.unpack_archive)shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

Python configparserConfiguration Injection via Carriage Return (\r) in write() method

pypi/tarfiletarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

Company

Resources

Contact