Search CVE reports
1 – 10 of 100 results
(When an Expat parser with a registered ElementDeclHandler parses an in ...)
13 affected packages
pypy3, python2.7, python3.4, python3.5, python3.6...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| pypy3 | Needs evaluation | Needs evaluation | Needs evaluation | — |
| python2.7 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Needs evaluation | — | — |
| python3.12 | Needs evaluation | Not in release | — | — |
| python3.13 | Not in release | Not in release | — | — |
| python3.14 | Not in release | Not in release | — | — |
(The fix for CVE-2026-0672, which rejected control characters in http.c ...)
12 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| python2.7 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Needs evaluation | — | — |
| python3.12 | Needs evaluation | Not in release | — | — |
| python3.13 | Not in release | Not in release | — | — |
| python3.14 | Not in release | Not in release | — | — |
(The "tarfile" module would still apply normalization of AREGTYPE (\x00 ...)
12 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| python2.7 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Needs evaluation | — | — |
| python3.12 | Needs evaluation | Not in release | — | — |
| python3.13 | Not in release | Not in release | — | — |
| python3.14 | Not in release | Not in release | — | — |
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this...
13 affected packages
pypy3, python2.7, python3.4, python3.5, python3.6...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| pypy3 | Needs evaluation | Needs evaluation | Needs evaluation | — |
| python2.7 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Needs evaluation | — | — |
| python3.12 | Needs evaluation | Not in release | — | — |
| python3.13 | Not in release | Not in release | — | — |
| python3.14 | Not in release | Not in release | — | — |
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit...
12 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| python2.7 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Needs evaluation | — | — |
| python3.12 | Needs evaluation | Not in release | — | — |
| python3.13 | Not in release | Not in release | — | — |
| python3.14 | Not in release | Not in release | — | — |
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if...
13 affected packages
pypy3, python2.7, python3.4, python3.5, python3.6...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| pypy3 | Needs evaluation | Needs evaluation | Needs evaluation | — |
| python2.7 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Needs evaluation | — | — |
| python3.12 | Needs evaluation | Not in release | — | — |
| python3.13 | Not in release | Not in release | — | — |
| python3.14 | Not in release | Not in release | — | — |
When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to...
13 affected packages
pypy3, python2.7, python3.4, python3.5, python3.6...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| pypy3 | Ignored | Ignored | Ignored | — |
| python2.7 | Not in release | Ignored | Ignored | Ignored |
| python3.4 | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | — | Ignored |
| python3.7 | Not in release | Not in release | — | Ignored |
| python3.8 | Not in release | Not in release | Ignored | Ignored |
| python3.9 | Not in release | Not in release | Ignored | — |
| python3.10 | Not in release | Ignored | — | — |
| python3.11 | Not in release | Ignored | — | — |
| python3.12 | Ignored | Not in release | — | — |
| python3.13 | Not in release | Not in release | — | — |
| python3.14 | Not in release | Not in release | — | — |
Some fixes available 13 of 18
User-controlled header names and values containing newlines can allow injecting HTTP headers.
12 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| python2.7 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | — | Fixed |
| python3.7 | Not in release | Not in release | — | Fixed |
| python3.8 | Not in release | Not in release | Fixed | Fixed |
| python3.9 | Not in release | Not in release | Fixed | — |
| python3.10 | Not in release | Fixed | — | — |
| python3.11 | Not in release | Fixed | — | — |
| python3.12 | Fixed | Not in release | — | — |
| python3.13 | Not in release | Not in release | — | — |
| python3.14 | Not in release | Not in release | — | — |
Some fixes available 13 of 18
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
12 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| python2.7 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | — | Fixed |
| python3.7 | Not in release | Not in release | — | Fixed |
| python3.8 | Not in release | Not in release | Fixed | Fixed |
| python3.9 | Not in release | Not in release | Fixed | — |
| python3.10 | Not in release | Fixed | — | — |
| python3.11 | Not in release | Fixed | — | — |
| python3.12 | Fixed | Not in release | — | — |
| python3.13 | Not in release | Not in release | — | — |
| python3.14 | Not in release | Not in release | — | — |
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
12 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| python2.7 | Not in release | Ignored | Ignored | Ignored |
| python3.4 | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | — | Ignored |
| python3.7 | Not in release | Not in release | — | Ignored |
| python3.8 | Not in release | Not in release | Ignored | Ignored |
| python3.9 | Not in release | Not in release | Ignored | — |
| python3.10 | Not in release | Ignored | — | — |
| python3.11 | Not in release | Ignored | — | — |
| python3.12 | Ignored | Not in release | — | — |
| python3.13 | Not in release | Not in release | — | — |
| python3.14 | Not in release | Not in release | — | — |