← All credits

Seth Larson (https://github.com/sethmlarson)

12 vulnerability records and advisories credit this contributor.

SSLContext.wrap_bio() missing validation of server_hostname parameter

Use-after-free of a server-side SSLContext when sni_callback switches contexts

stringprep.map_table_b2() deviates from RFC 3454 Table B.2

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Configuration Injection via Carriage Return (\r) in write() method

Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

tarfile.data_filter path traversal bypass allows writing outside the extraction directory

Tarfile.extract() doesn't fully respect filter parameter

Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes

Potential DoS via quadratic complexity in unicodedata.normalize()