Python Software Foundation CPython vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 202515
3. 202642
4. 202620

Newest CVEs

• CVE-2026-116566

  socket.getaddrinfo() accepts embedded null bytes in host and port

  Python Software Foundation · CPython

  Medium5.3
• CVE-2026-103995

  Lenient parsing of integers for response body and chunk framing

  Python Software Foundation · CPython

  Low2.0
• CVE-2026-115557

  Distrust compromised intermediate certificates in ssl module

  Python Software Foundation · CPython

  Critical9.4
• CVE-2026-114583

  tar filter allows writing outside destination via empty-named symlink

  Python Software Foundation · CPython

  Medium6.9
• CVE-2026-19553

  SSLContext.wrap_bio() missing validation of server_hostname parameter

  Python Software Foundation · CPython

  High7.6
• CVE-2026-19445

  Use-after-free of a server-side SSLContext when sni_callback switches contexts

  Python Software Foundation · CPython

  Critical9.2
• CVE-2026-12345

  Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

  Python Software Foundation · CPython

  Medium5.9
• CVE-2026-82049

  tarfile extraction filters allow file modification and content disclosure via hard link to symlink

  Python Software Foundation · CPython

  High8.4
• CVE-2026-87910

  tarfile hardlink fallback ignores custom extraction filter rejection via None

  Python Software Foundation · CPython

  Medium5.7
• CVE-2026-15310

  zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

  Python Software Foundation · CPython

  Low2.1