CVE Tools
Track your stack

Cpython

89 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Cpython, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Cpython CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Cpython CVEs per month
MonthCVEs
2024-121
2025-011
2025-022
2025-030
2025-040
2025-051
2025-066
2025-071
2025-080
2025-090
2025-102
2025-111
2025-123
2026-018
2026-020
2026-036
2026-048
2026-052
2026-069
2026-072
2026-085
2026-095
2026-104
2026-116

Severity

How the 89 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical35%
  • High2444%
  • Medium2444%
  • Low47%

Latest CVEs

The 15 most recently published vulnerabilities affecting Cpython.

  1. CVE-2026-16052Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel—
  2. CVE-2026-115559imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS—
  3. CVE-2026-115791Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction—
  4. CVE-2026-124249`http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation—
  5. CVE-2026-19552ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity—
  6. CVE-2026-119170Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10—
  7. CVE-2026-116566socket.getaddrinfo() accepts embedded null bytes in host and port—
  8. CVE-2026-103995Lenient parsing of integers for response body and chunk framing—
  9. CVE-2026-115557Distrust compromised intermediate certificates in ssl module—
  10. CVE-2026-114583tar filter allows writing outside destination via empty-named symlink—
  11. CVE-2026-19553SSLContext.wrap_bio() missing validation of server_hostname parameter—
  12. CVE-2026-19445Use-after-free of a server-side SSLContext when sni_callback switches contexts—
  13. CVE-2026-12345Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory—
  14. CVE-2026-82049tarfile extraction filters allow file modification and content disclosure via hard link to symlink—
  15. CVE-2026-87910tarfile hardlink fallback ignores custom extraction filter rejection via None—

Product grouping is registry-driven, with AI assist and human review. How it works