https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:24:11 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-06436 bdu:2026-06436 https://cve.radiocsirt.org/vuln/bdu:2026-06436 https://cve.radiocsirt.org/vuln/bell-cve-2025-11468 <p><strong>Affected:</strong> Alpaquita:23: python3, Alpaquita:25: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:25: python3, BellSoft Hardened Containers:stream: python3</p> <p><strong>Affected:</strong> Alpaquita:23: python3, Alpaquita:25: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:25: python3, BellSoft Hardened Containers:stream: python3</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-11468 https://cve.radiocsirt.org/vuln/bit-libpython-2025-11468 <p><strong>Affected:</strong> Bitnami: libpython</p> <p>When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.</p> <p><strong>Affected:</strong> Bitnami: libpython</p> <p>When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.</p> https://cve.radiocsirt.org/vuln/bit-libpython-2025-11468 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0067 certfr-2026-avi-0067 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0067 https://cve.radiocsirt.org/vuln/euvd-2026-274029 EUVD-2026-274029 https://cve.radiocsirt.org/vuln/euvd-2026-274029 https://cve.radiocsirt.org/vuln/fkie_cve-2025-11468 <p>When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.</p> <p>When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-11468 https://cve.radiocsirt.org/vuln/ghsa-39h2-3mq3-959g <p>When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.</p> <p>When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.</p> https://cve.radiocsirt.org/vuln/ghsa-39h2-3mq3-959g https://cve.radiocsirt.org/vuln/oesa-2026-1458 <p><strong>Affected:</strong> openEuler:24.03-LTS: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>In CPython&amp;apos;s email module, when folding a long comment containing exclusively unfoldable characters, the parentheses are not preserved. This could be exploited to inject headers into email messages in scenarios where email addresses are user-controlled and not sanitized.(CVE-2025-11468)</p> <p>User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.(CVE-2025-15282)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>In CPython&amp;apos;s email module, when folding a long comment containing exclusively unfoldable characters, the parentheses are not preserved. This could be exploited to inject headers into email messages in scenarios where email addresses are user-controlled and not sanitized.(CVE-2025-11468)</p> <p>User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.(CVE-2025-15282)</p> https://cve.radiocsirt.org/vuln/oesa-2026-1458 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10117-1 <p>python314-3.14.2-2.1 on GA media</p> <p>python314-3.14.2-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10117-1 https://cve.radiocsirt.org/vuln/rhsa-2026:7443 <p>python: Quadratic complexity in os.path.expandvars() with user-controlled template cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked cpython: Missing character filtering in Python cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service cpython: cpython: `tarfile` module misinterprets crafted tar archives leading to data integrity issues cpython: Excessive read buffering DoS in http.client cpython: Out-of-memory when loading Plist cpython: Header injection via newlines in data URL mediatype in Python cpython: POP3 command injection in user-controlled commands cpython: wsgiref.headers.Headers allows header newline injection in Python cpython: email header injection due to unquoted newlines cpython: CPython: Logging Bypass in Legacy .pyc File Handling python: Python base64: Incomplete data decoding due to premature stop at padding python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation cpython: Incomplete control character validation in http.cookies cpython: Stack overflow parsing XML with deeply nested DTD content models python: Python: Command-line option injection in webbrowser.open() via crafted URLs python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process.</p> <p>python: Quadratic complexity in os.path.expandvars() with user-controlled template cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked cpython: Missing character filtering in Python cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service cpython: cpython: `tarfile` module misinterprets crafted tar archives leading to data integrity issues cpython: Excessive read buffering DoS in http.client cpython: Out-of-memory when loading Plist cpython: Header injection via newlines in data URL mediatype in Python cpython: POP3 command injection in user-controlled commands cpython: wsgiref.headers.Headers allows header newline injection in Python cpython: email header injection due to unquoted newlines cpython: CPython: Logging Bypass in Legacy .pyc File Handling python: Python base64: Incomplete data decoding due to premature stop at padding python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation cpython: Incomplete control character validation in http.cookies cpython: Stack overflow parsing XML with deeply nested DTD content models python: Python: Command-line option injection in webbrowser.open() via crafted URLs python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process.</p> https://cve.radiocsirt.org/vuln/rhsa-2026:7443 https://cve.radiocsirt.org/vuln/suse-su-2026:0612-1 <p>Security update for python36</p> <p>Security update for python36</p> https://cve.radiocsirt.org/vuln/suse-su-2026:0612-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-11468 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.9, Ubuntu:22.04:LTS: python3.10, Ubuntu:Pro:22.04:LTS: python3.11, Ubuntu:24.04:LTS: python3.12, Ubuntu:25.10: python3.13, Ubuntu:25.10: python3.14</p> <p>When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.9, Ubuntu:22.04:LTS: python3.10, Ubuntu:Pro:22.04:LTS: python3.11, Ubuntu:24.04:LTS: python3.12, Ubuntu:25.10: python3.13, Ubuntu:25.10: python3.14</p> <p>When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-11468 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0209 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cpython ausnutzen, um Dateien zu manipulieren oder beliebigen Code auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cpython ausnutzen, um Dateien zu manipulieren oder beliebigen Code auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0209