https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 04:07:28 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:1374 <p><strong>Affected:</strong> AlmaLinux:8: python3.11, AlmaLinux:8: python3.11-debug, AlmaLinux:8: python3.11-devel, AlmaLinux:8: python3.11-idle, AlmaLinux:8: python3.11-libs, AlmaLinux:8: python3.11-rpm-macros, AlmaLinux:8: python3.11-test, AlmaLinux:8: python3.11-tkinter</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* cpython: Excessive read buffering DoS in http.client (CVE-2025-13836) * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: python3.11, AlmaLinux:8: python3.11-debug, AlmaLinux:8: python3.11-devel, AlmaLinux:8: python3.11-idle, AlmaLinux:8: python3.11-libs, AlmaLinux:8: python3.11-rpm-macros, AlmaLinux:8: python3.11-test, AlmaLinux:8: python3.11-tkinter</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* cpython: Excessive read buffering DoS in http.client (CVE-2025-13836) * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:1374 https://cve.radiocsirt.org/vuln/bdu:2026-05127 bdu:2026-05127 https://cve.radiocsirt.org/vuln/bdu:2026-05127 https://cve.radiocsirt.org/vuln/bell-cve-2025-13836 <p><strong>Affected:</strong> Alpaquita:23: python3, Alpaquita:25: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:25: python3, BellSoft Hardened Containers:stream: python3</p> <p><strong>Affected:</strong> Alpaquita:23: python3, Alpaquita:25: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:25: python3, BellSoft Hardened Containers:stream: python3</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-13836 https://cve.radiocsirt.org/vuln/bit-libpython-2025-13836 <p><strong>Affected:</strong> Bitnami: libpython</p> <p>When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.</p> <p><strong>Affected:</strong> Bitnami: libpython</p> <p>When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.</p> https://cve.radiocsirt.org/vuln/bit-libpython-2025-13836 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1060 certfr-2025-avi-1060 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1060 https://cve.radiocsirt.org/vuln/euvd-2026-274031 EUVD-2026-274031 https://cve.radiocsirt.org/vuln/euvd-2026-274031 https://cve.radiocsirt.org/vuln/fkie_cve-2025-13836 <p>When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.</p> <p>When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-13836 https://cve.radiocsirt.org/vuln/ghsa-399h-rrqc-rpgv <p>When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.</p> <p>When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.</p> https://cve.radiocsirt.org/vuln/ghsa-399h-rrqc-rpgv https://cve.radiocsirt.org/vuln/msrc_cve-2025-13836 msrc_CVE-2025-13836 https://cve.radiocsirt.org/vuln/msrc_cve-2025-13836 https://cve.radiocsirt.org/vuln/oesa-2026-1052 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)</p> <p>When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)</p> <p>When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)</p> <p>When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)</p> <p>When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)</p> https://cve.radiocsirt.org/vuln/oesa-2026-1052 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15839-1 <p>python310-3.10.19-3.1 on GA media</p> <p>python310-3.10.19-3.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15839-1 https://cve.radiocsirt.org/vuln/rhsa-2026:16174 <p>libxslt: Processing web content may disclose sensitive information libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service cpython: Excessive read buffering DoS in http.client gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification cpython: IMAP command injection in user-controlled commands cpython: POP3 command injection in user-controlled commands python: protobuf: Protobuf: Denial of Service due to recursion depth bypass cpython: email header injection due to unquoted newlines libvpx: Heap buffer overflow in libvpx openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API giflib: Giflib: Double-free vulnerability leading to memory corruption…</p> <p>libxslt: Processing web content may disclose sensitive information libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service cpython: Excessive read buffering DoS in http.client gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification cpython: IMAP command injection in user-controlled commands cpython: POP3 command injection in user-controlled commands python: protobuf: Protobuf: Denial of Service due to recursion depth bypass cpython: email header injection due to unquoted newlines libvpx: Heap buffer overflow in libvpx openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API giflib: Giflib: Double-free vulnerability leading to memory corruption…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:16174 https://cve.radiocsirt.org/vuln/suse-el-9-client-tools-2026-1026 <p>Security update 5.0.7 for Multi-Linux Manager Salt Bundle</p> <p>Security update 5.0.7 for Multi-Linux Manager Salt Bundle</p> https://cve.radiocsirt.org/vuln/suse-el-9-client-tools-2026-1026 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-13836 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.9, Ubuntu:22.04:LTS: python3.10, Ubuntu:Pro:22.04:LTS: python3.11, Ubuntu:24.04:LTS: python3.12, Ubuntu:25.10: python3.13, Ubuntu:25.10: python3.14</p> <p>When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.9, Ubuntu:22.04:LTS: python3.10, Ubuntu:Pro:22.04:LTS: python3.11, Ubuntu:24.04:LTS: python3.12, Ubuntu:25.10: python3.13, Ubuntu:25.10: python3.14</p> <p>When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-13836 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2706 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Python ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Python ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2706