https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:23:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-377958 EUVD-2026-377958 https://cve.radiocsirt.org/vuln/euvd-2026-377958 https://cve.radiocsirt.org/vuln/fkie_cve-2026-76875 <p>PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module&#39;s ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a reference to the parent parser. The child parser retains a raw C back-pointer to the parent parser struct while PyPy&#39;s tracing garbage collector can free the parent&#39;s C struct, causing bundled libexpat to dereference the freed pointer on every parsed token, producing memory corruption.</p> <p>PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module&#39;s ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a reference to the parent parser. The child parser retains a raw C back-pointer to the parent parser struct while PyPy&#39;s tracing garbage collector can free the parent&#39;s C struct, causing bundled libexpat to dereference the freed pointer on every parsed token, producing memory corruption.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-76875 https://cve.radiocsirt.org/vuln/ghsa-4h3r-h8c5-46cf <p>PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module&#39;s ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a reference to the parent parser. The child parser retains a raw C back-pointer to the parent parser struct while PyPy&#39;s tracing garbage collector can free the parent&#39;s C struct, causing bundled libexpat to dereference the freed pointer on every parsed token, producing memory corruption.</p> <p>PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module&#39;s ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a reference to the parent parser. The child parser retains a raw C back-pointer to the parent parser struct while PyPy&#39;s tracing garbage collector can free the parent&#39;s C struct, causing bundled libexpat to dereference the freed pointer on every parsed token, producing memory corruption.</p> https://cve.radiocsirt.org/vuln/ghsa-4h3r-h8c5-46cf https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-76875 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: pypy3, Ubuntu:22.04:LTS: pypy3, Ubuntu:24.04:LTS: pypy3, Ubuntu:26.04:LTS: pypy3</p> <p>PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module&#39;s ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a reference to the parent parser. The child parser retains a raw C back-pointer to the parent parser struct while PyPy&#39;s tracing garbage collector can free the parent&#39;s C struct, causing bundled libexpat to dereference the freed pointer on every parsed token, producing memory corruption.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: pypy3, Ubuntu:22.04:LTS: pypy3, Ubuntu:24.04:LTS: pypy3, Ubuntu:26.04:LTS: pypy3</p> <p>PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module&#39;s ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a reference to the parent parser. The child parser retains a raw C back-pointer to the parent parser struct while PyPy&#39;s tracing garbage collector can free the parent&#39;s C struct, causing bundled libexpat to dereference the freed pointer on every parsed token, producing memory corruption.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-76875