Cpython

This hub aggregates every CVE we track for Cpython, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Cpython.

• CVE-2026-82049tarfile extraction filters allow file modification and content disclosure via hard link to symlinkSep 14, 2026
• CVE-2026-87910tarfile hardlink fallback ignores custom extraction filter rejection via NoneSep 11, 2026
• CVE-2026-15310zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limitsAug 25, 2026
• CVE-2026-19672tarfile extraction filter bypass allows creation of directories outside the destinationAug 19, 2026
• CVE-2026-15806`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matchingAug 18, 2026
• CVE-2026-17084stringprep.map_table_b2() deviates from RFC 3454 Table B.2Aug 18, 2026
• CVE-2026-18503Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()Aug 10, 2026
• CVE-2026-6879Quadratic Behavior in xml.etree.ElementPath Index PredicatesJul 28, 2026
• CVE-2026-15308Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations7.5Jul 9, 2026
• CVE-2026-4360Tarfile.extract() doesn't fully respect filter parameter5.3Jun 30, 2026
• CVE-2026-11972tarfile opened in streaming mode mishandles EOFJun 23, 2026
• CVE-2026-0864Configuration Injection via Carriage Return (\r) in write() method5.5Jun 23, 2026
• CVE-2026-11940tarfile extraction filter bypass allows escaping the destination directoryJun 23, 2026
• BDU:2026-08551Уязвимость функции ast_for_if_stmt() интерпретатора языка программирования Python (CPython), связанная с ошибками разыменования указателей, позволяющая нарушителю вызвать отказ в обслуживании5.5Jun 22, 2026
• CVE-2026-12003CPython >3.11 Insecure Input Validation resulting in privilege escalationJun 16, 2026