Most recent entries from all

BELL-CVE-2026-18503

Affected: Alpaquita:23: python3, Alpaquita:25: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:25: python3

BIT-libpython-2026-18503 — Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Affected: Bitnami: libpython

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

certfr-2026-avi-0994 — Une vulnérabilité a été découverte dans CPython. Elle permet à un attaquant de provoquer un déni de service à distance.

certfr-2026-avi-0994

EUVD-2026-351831

fkie_cve-2026-18503

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

GHSA-2345-wr3r-cxf2

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

msrc_CVE-2026-18503 — Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

msrc_CVE-2026-18503

OESA-2026-4009 — python3 security update

Affected: openEuler:24.03-LTS-SP1: python3

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.(CVE-2026-15806)

The &qu…

openSUSE-SU-2026:11817-1 — python313-3.13.15-1.1 on GA media

python313-3.13.15-1.1 on GA media

RHSA-2026:54534 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

python: Python Tarfile: Unexpected file ownership when extracting hardlinks python: Python: Performance degradation in XML processing due to quadratic time complexity python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff()

SUSE-SU-2026:4411-1 — Security update for python

Security update for python

UBUNTU-CVE-2026-18503

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 7 more

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().