PatchFirst · Latest vulnerabilities
Vulnerabilities published for python in the last 30 days: 2. Listed in the KEV catalogue: 0.
Vulnerabilities: 16
This update for python, python-base, python-doc fixes the following issue: - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure (bsc#1280459).
This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consu
This update for python fixes the following issues: Security issues fixed: - CVE-2026-13346: pip: arbitrary file installation via malicious package indexes (bsc#1273091). Non security issue fixed: - Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl
This update for python fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599). - CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262467). - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-6357: pip self-update functionality can imp
This update for python, python-base, python-doc fixes the following issues Security fixes: - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599). - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429). - CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970). - CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319). - CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters (bsc#1262654). - CVE-2026-6100: Arbitrary code
This update for python fixes the following issues: - CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611). - CVE-2026-3479: improper resource argument validation can allow path traversal (bsc#1259989). - CVE-2026-3644: incomplete control character validation in `http.cookies` (bsc#1259734). - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735). - CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web browser command line option injection (bsc#1260026).
This update for python fixes the following issue: - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in `BytesGenerator` (bsc#1257181).
This update for python fixes the following issues: - CVE-2024-7592: excess CPU resource consumption in http.cookies module (bsc#1229596)
This update for python fixes the following issues: - CVE-2025-6075: Fixed performance degradation when using os.path.expandvars() (bsc#1252974). - CVE-2026-0672: Fixed a HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel. (bsc#1257031) - CVE-2026-0865: Fixed a bug where a user-controlled header containing newlines can allow injecting HTTP headers. (bsc#1257042) - CVE-2025-15366: Fixed a bug wherer a user-controlled command can allow additional commands injected using newlines. (bsc#1257044) - CVE-2025-15367: Fixed control characters which may allow the injection of additional commands. (bsc#
This update for python fixes the following issues: - CVE-2025-8291: check validity of the ZIP64 End of Central Directory (EOCD) in the 'zipfile' module (bsc#1251305). - CVE-2025-12084: prevent quadratic behavior in node ID cache clearing (bsc#1254997). - CVE-2025-13836: prevent reading an HTTP response from a server, if no read amount is specified, with using Content-Length per default as the length (bsc#1254400).
This update for python fixes the following issues: - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
This update for python fixes the following issues: - CVE-2025-6069: Fixed worst case quadratic complexity that can lead to amplified DoS. (bsc#1244705)
This update for python fixes the following issues: - CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses (bsc#1233307).
This update for python fixes the following issues: - Reference to no longer used 'bracketed_host' variable in the fix for CVE-2025-0938 (bsc#1236705, bsc#1223694).
This update for python fixes the following issues: - CVE-2025-0938: functions `urllib.parse.urlsplit` and `urlparse` accept domain names including square brackets (bsc#1236705).
This update for python fixes the following issues: - CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses (bsc#1233307) Other fixes:
Check your installed stack and versions against the current vulnerability feeds.