Python Security Vulnerabilities

Warning

This resource is maintained for historical reference and does not contain the latest vulnerability info for Python.

The canonical database for vulnerabilities affecting Python is available on GitHub in the Open Source Vulnerability (OSV) format. This database can be viewed online at the Open Source Vulnerability Database.

Status of Python branches lists Python branches which get security fixes.

Total: 95 vulnerabilities.

Vulnerability Disclosure Fixed In Vulnerable CVE
Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple 2023-03-24 – 3.10
3.7
3.8
3.9		 CVE-2023-27043
urlparse does not correctly handle schemes 2022-11-12 3.11.1 3.10
3.7
3.8
3.9		 CVE-2023-24329
Buffer overflow in the _sha3 module in Python 3.10 and older 2022-10-21 3.7.16
3.8.16
3.9.16
3.10.9		 – CVE-2022-37454
Slow IDNA decoding with large strings 2022-10-19 3.7.16
3.8.16
3.9.16
3.10.9
3.11.1		 – CVE-2022-45061
Linux specific local privilege escalation via the multiprocessing forkserver start method 2022-09-23 3.9.16
3.10.9
3.11.0		 – CVE-2022-42919
Prevent DoS by large str-int conversions 2022-08-08 3.7.14
3.8.14
3.9.14
3.10.7
3.11.0		 – CVE-2020-10735
Windows: vulnerable zlib 1.2.11 2022-04-01 3.7.14
3.8.14
3.9.13
3.10.5		 – CVE-2018-25032
Windows: vulnerable bzip2 1.0.6 2021-07-02 3.7.13
3.8.13
3.9.11
3.10.3		 – CVE-2016-3189
CVE-2019-12900
CVE-2013-0340 Billion Laughs fixed in Expat 2.4.0 2021-06-11 3.6.15
3.7.12
3.8.12
3.9.7
3.10.0		 – CVE-2013-0340
CVE-2021-3737: urllib HTTP client possible infinite loop on a 100 Continue response 2021-05-03 3.6.14
3.7.11
3.8.11
3.9.6
3.10.0		 – CVE-2021-3737
urllib.parse should sanitize urls containing ASCII newline and tabs. 2021-04-18 3.6.14
3.7.11
3.8.11
3.9.5
3.10.0		 – CVE-2022-0391
ipaddress leading zeros in IPv4 address 2021-03-30 3.8.12
3.9.5
3.10.0		 – CVE-2021-29921
ftplib should not use the host from the PASV response 2021-02-21 3.6.14
3.7.11
3.8.9
3.9.3
3.10.0		 – –
http.server: Open Redirection if the URL path starts with // 2021-02-14 3.7.14
3.8.14
3.9.14
3.10.6
3.11.0		 – CVE-2021-28861
CVE-2021-3733: ReDoS in urllib.request 2021-01-30 3.6.14
3.7.11
3.8.10
3.9.5
3.10.0		 – CVE-2021-3733
Information disclosure via pydoc getfile 2021-01-21 3.6.14
3.7.11
3.8.9
3.9.3
3.10.0		 – CVE-2021-3426
urllib parse_qsl(): Web cache poisoning - semicolon as a query args separator 2021-01-19 3.6.13
3.7.10
3.8.8
3.9.2
3.10.0		 – CVE-2021-23336
ctypes: Buffer overflow in PyCArg_repr 2021-01-16 3.6.13
3.7.10
3.8.8
3.9.2
3.10.0		 – CVE-2021-3177
CJK codecs tests call eval() on content retrieved via HTTP 2020-10-05 3.6.13
3.7.10
3.8.7
3.9.1
3.10.0		 – CVE-2020-27619
[CVE-2020-14422] Hash collisions in IPv4Interface and IPv6Interface 2020-06-17 3.5.10
3.6.12
3.7.9
3.8.4
3.9.0		 – CVE-2020-14422
http.client: HTTP Header Injection in the HTTP method 2020-02-10 3.5.10
3.6.12
3.7.9
3.8.5
3.9.0		 – CVE-2020-26116
CVE-2020-8315: Unsafe DLL loading in getpathp.c on Windows 7 2020-01-21 3.6.11
3.7.7
3.8.2
3.9.0		 – CVE-2020-8315
Email header injection in Address objects 2019-12-17 3.5.10
3.6.11
3.7.8
3.8.4
3.9.0		 – –
Infinite loop in tarfile module while opening a crafted file 2019-12-10 3.5.10
3.6.12
3.7.9
3.8.5
3.9.0		 – CVE-2019-20907
Remove newline characters from uu encoding methods 2019-11-30 2.7.18
3.5.10
3.6.10
3.7.6
3.8.1
3.9.0		 – –
urllib basic auth regex denial of service 2019-11-17 3.5.10
3.6.11
3.7.8
3.8.3
3.9.0		 – CVE-2020-8492
Regular Expression Denial of Service in http.cookiejar 2019-11-14 2.7.18
3.5.10
3.6.10
3.7.6
3.8.1
3.9.0		 – –
CVE-2019-18348: CRLF injection via the host part of the url passed to urlopen() 2019-10-24 2.7.18
3.5.10
3.6.11
3.7.8
3.8.3
3.9.0		 – CVE-2019-18348
Reflected XSS in DocXMLRPCServer 2019-09-21 2.7.17
3.5.8
3.6.10
3.7.5
3.8.0		 – CVE-2019-16935
ssl.match_hostname() ignores extra string after whitespace in IPv4 address 2019-07-01 3.7.4
3.8.0		 – –
urlsplit does not handle NFKC normalization (second fix) 2019-04-27 2.7.17
3.5.8
3.6.9
3.7.4
3.8.0		 – CVE-2019-10160
urlsplit does not handle NFKC normalization 2019-03-06 2.7.17
3.5.7
3.6.9
3.7.3
3.8.0		 – CVE-2019-9636
urllib module local_file:// scheme 2019-02-06 2.7.17
3.5.8
3.6.9
3.7.4
3.8.0		 – CVE-2019-9948
TALOS-2018-0758 SSL CRL distribution points Denial of Service 2019-01-15 2.7.16
3.4.10
3.5.7
3.6.9
3.7.3
3.8.0		 – CVE-2019-5010
http.cookiejar: Incorrect validation of path 2019-01-03 2.7.17
3.4.10
3.5.7
3.6.9
3.7.3
3.8.0		 – –
xml package does not obey ignore_environment 2018-09-24 2.7.16
3.4.10
3.5.7
3.6.8
3.7.2
3.8.0		 – –
pickle.load denial of service 2018-09-13 3.4.10
3.5.7
3.6.7
3.7.1
3.8.0		 – CVE-2018-20406
_elementree C accelerator doesn’t call XML_SetHashSalt() 2018-09-10 2.7.16
3.4.10
3.5.7
3.6.7
3.7.1
3.8.0		 – CVE-2018-14647
email.utils.parseaddr mistakenly parse an email 2018-07-19 2.7.17
3.5.8
3.6.10
3.7.5
3.8.0		 – CVE-2019-16056
Email folding function Denial-of-Service 2018-05-16 3.6.9
3.7.4
3.8.0		 – –
Buffer overflow vulnerability in os.symlink on Windows 2018-03-05 3.4.9
3.5.6
3.6.5
3.7.0		 – CVE-2018-1000117
difflib and poplib catastrophic backtracking 2018-03-02 2.7.15
3.4.9
3.5.6
3.6.5
3.7.0		 – CVE-2018-1060
CVE-2018-1061
Python 2.7 readahead is not thread safe 2017-09-20 2.7.15 – CVE-2018-1000030
Expat 2.2.3 2017-07-17 2.7.14
3.3.7
3.4.8
3.5.5
3.6.3
3.7.0		 – –
Environment variables injection in subprocess on Windows 2017-06-22 2.7.14
3.3.7
3.4.7
3.5.4
3.6.2
3.7.0		 – –
Expat 2.2.1 2017-06-17 2.7.14
3.3.7
3.4.7
3.5.4
3.6.2
3.7.0		 – CVE-2012-0876
CVE-2016-0718
CVE-2016-9063
CVE-2017-9233
PyString_DecodeEscape integer overflow 2017-06-13 2.7.14
3.4.8
3.5.5		 – CVE-2017-1000158
bpo-30500: urllib connects to a wrong host 2017-05-29 2.7.14
3.3.7
3.4.7
3.5.4
3.6.2
3.7.0		 – –
HTTP Header Injection (follow-up of CVE-2016-5699) 2017-05-24 2.7.17
3.5.8
3.6.9
3.7.4
3.8.0		 – CVE-2019-9740
CVE-2019-9947
Py_SetPath(): _Py_CheckPython3 uses uninitialized DLL path 2017-03-10 3.5.10
3.6.12
3.7.9
3.8.4
3.9.0		 – CVE-2020-15523
urllib FTP protocol stream injection 2017-02-20 2.7.14
3.3.7
3.4.7
3.5.4
3.6.3
3.7.0		 – –
Expat 2.2 (Expat bug #537) 2017-02-17 2.7.14
3.3.7
3.4.7
3.5.4
3.6.2
3.7.0		 – CVE-2016-0718
CVE-2016-4472
Zlib 1.2.11 2017-01-05 2.7.14
3.4.8
3.5.4
3.6.1
3.7.0		 – CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
gettext.c2py() 2016-10-30 2.7.13
3.3.7
3.4.6
3.5.3
3.6.0		 – –
Sweet32 attack (DES, 3DES) 2016-08-24 2.7.13
3.4.7
3.5.3
3.6.0		 – CVE-2016-2183
HTTPoxy attack 2016-07-18 2.7.13
3.3.7
3.4.6
3.5.3
3.6.0		 – CVE-2016-1000110
smtplib TLS stripping 2016-06-11 2.7.12
3.3.7
3.4.5
3.5.2
3.6.0		 – CVE-2016-0772
Issue #26657: HTTP server directory traversal 2016-03-28 2.7.12
3.3.7
3.4.7
3.5.2
3.6.0		 – –
Issue #26556: Expat 2.1.1 2016-03-14 2.7.12
3.3.7
3.4.5
3.5.2
3.6.0		 – CVE-2015-1283
zipimporter overflow 2016-01-21 2.7.12
3.3.7
3.4.5
3.5.2
3.6.0		 – CVE-2016-5636
mailcap shell command injection 2015-08-02 3.7.16
3.8.16
3.9.16
3.10.8
3.11.0		 – CVE-2015-20107
HTTP header injection 2014-11-24 2.7.10
3.3.7
3.4.4
3.5.0		 – CVE-2016-5699
Validate TLS certificate 2014-08-28 2.7.9
3.4.3
3.5.0		 – CVE-2014-9365
buffer() integer overflows 2014-06-24 2.7.8 – CVE-2014-7185
JSONDecoder.raw_decode 2014-04-13 2.7.7
3.2.6
3.3.6
3.4.1
3.5.0		 – CVE-2014-4616
os.makedirs() not thread-safe 2014-03-28 3.2.6
3.3.6
3.4.1
3.5.0		 – CVE-2014-2667
socket.recvfrom_into() overflow 2014-01-14 2.7.7
3.2.6
3.3.4
3.4.0		 – CVE-2014-1912
zipfile DoS using invalid file size 2013-12-27 3.3.4
3.4.0		 – CVE-2013-7338
CGI directory traversal (URL parsing) 2013-10-29 2.7.6
3.2.6
3.3.4
3.4.0		 – –
ssl: NULL in subjectAltNames 2013-06-27 2.6.9
2.7.6
3.2.6
3.3.3
3.4.0		 – CVE-2013-4238
ssl.match_hostname() IDNA issue 2013-05-17 3.3.3
3.4.0		 – CVE-2013-7440
ssl.match_hostname() wildcard DoS 2013-05-15 3.2.6
3.3.3
3.4.0		 – CVE-2013-2099
Limit imaplib.IMAP4_SSL.readline() 2012-09-25 2.7.16 – CVE-2013-1752
ftplib unlimited read 2012-09-25 2.7.6
3.2.6
3.3.3
3.4.0		 – CVE-2013-1752
nntplib unlimited read 2012-09-25 2.6.9
2.7.6
3.2.6
3.3.7
3.4.3
3.5.0		 – CVE-2013-1752
poplib unlimited read 2012-09-25 2.7.9
3.2.6
3.3.7
3.4.3
3.5.0		 – CVE-2013-1752
smtplib unlimited read 2012-09-25 2.7.9
3.2.6
3.3.7
3.4.3
3.5.0		 – CVE-2013-1752
xmlrpc gzip unlimited read 2012-09-25 2.7.9
3.3.7
3.4.3
3.5.0		 – CVE-2013-1753
Hash function not randomized properly 2012-04-19 3.4.0 – CVE-2013-7040
Vulnerability in the utf-16 decoder after error handling 2012-04-14 2.7.4
3.2.4
3.3.0		 – CVE-2012-2135
XML-RPC DoS 2012-02-13 2.6.8
2.7.3
3.1.5
3.2.3
3.3.0		 – CVE-2012-0845
ssl CBC IV attack 2012-01-27 2.6.8
2.7.3
3.1.5
3.2.3
3.3.0		 – CVE-2011-3389
Hash DoS 2011-12-28 2.6.8
2.7.3
3.1.5
3.2.3
3.3.0		 – CVE-2012-1150
pypirc created insecurely 2011-11-30 2.7.4
3.2.4
3.3.1
3.4.0		 – CVE-2011-4944
urllib redirect 2011-03-24 2.5.6
2.6.7
2.7.2
3.1.4
3.2.1
3.3.0		 – CVE-2011-1521
SimpleHTTPServer UTF-7 2011-03-08 2.5.6
2.6.7
2.7.2
3.2.4
3.3.1
3.4.0		 – CVE-2011-4940
audioop integer overflows 2010-05-10 2.6.6
2.7.0
3.1.3
3.2.0		 – CVE-2010-1634
audioop input validation 2010-01-11 2.6.6
2.7.2
3.1.3
3.2.0		 – CVE-2010-2089
httplib unlimited read 2009-08-28 2.7.2
3.1.4
3.2.0		 – CVE-2013-1752
smtpd accept bug and race condition 2009-08-14 2.7.1
3.1.3
3.2.0		 – CVE-2010-3492
CVE-2010-3493
Multiple integer overflows (Apple) 2008-07-31 2.6.0
3.0.0		 – CVE-2008-1679
CVE-2008-1721
CVE-2008-1887
CVE-2008-2315
CVE-2008-2316
CVE-2008-3142
CVE-2008-3144
CVE-2008-4864
Multiple integer overflows (Google) 2008-04-11 2.5.3
2.6.0
3.0.0		 – CVE-2008-3143
expandtab() integer overflow 2008-03-11 2.5.3
2.6.0
3.0.0		 – CVE-2008-5031
CGI directory traversal (is_cgi() function) 2008-03-07 2.7.0
3.2.4
3.3.1
3.4.0		 – CVE-2011-1015
rgbimg and imageop overflows 2007-09-16 2.5.3
2.6.0		 – CVE-2007-4965
CVE-2009-4134
CVE-2010-1449
CVE-2010-1450

Table of Contents: