https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 19:15:06 +0000 https://cve.radiocsirt.org/vuln/cve-2026-1502 <p><strong>Affected:</strong> Python Software Foundation CPython</p> <p>CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.</p> <p><strong>Affected:</strong> Python Software Foundation CPython</p> <p>CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.</p> https://cve.radiocsirt.org/vuln/cve-2026-1502 https://cve.radiocsirt.org/vuln/usn-8509-1 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: python3.10, Ubuntu:24.04:LTS: python3.12, Ubuntu:26.04:LTS: python3.14</p> <p>It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-13462)</p> <p>It was discovered that Python&#39;s HTMLParser incorrectly handled certain malformed HTML input. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)</p> <p>It was discovered that Python&#39;s email module incorrectly quoted newlines in headers. An attacker could possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-1299)</p> <p>It was discovered that Python&#39;s http.client module did not properly sanitize carriage return and linefeed characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-1502)</p> <p>It was discovered that Python&#39;s importlib module did not generate an audit event when loading legacy .pyc files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)</p> <p>It was discovered that Python&#39;s unicodedata.normalize() function had incorrect algorithmic complexity. An attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial of…</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: python3.10, Ubuntu:24.04:LTS: python3.12, Ubuntu:26.04:LTS: python3.14</p> <p>It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-13462)</p> <p>It was discovered that Python&#39;s HTMLParser incorrectly handled certain malformed HTML input. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)</p> <p>It was discovered that Python&#39;s email module incorrectly quoted newlines in headers. An attacker could possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-1299)</p> <p>It was discovered that Python&#39;s http.client module did not properly sanitize carriage return and linefeed characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-1502)</p> <p>It was discovered that Python&#39;s importlib module did not generate an audit event when loading legacy .pyc files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)</p> <p>It was discovered that Python&#39;s unicodedata.normalize() function had incorrect algorithmic complexity. An attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial of…</p> https://cve.radiocsirt.org/vuln/usn-8509-1