Threats affecting pkg:github/CPython

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

A vulnerability in Python's tarfile module (tar_filter) allows crafted tar archives with empty-named or directory-like symlinks to bypass filtering and write files outside the intended extraction directory. This can occur when using tarfile.extractall() with filter="tar". The flaw affects multiple Python versions prior to their respective fixed releases.

CVE-2026-19553 is a vulnerability in Python's CPython ssl module where SSLContext.wrap_bio() does not require the server_hostname argument to be non-None when SSLContext.check_hostname is enabled. This causes hostname verification to be silently skipped if server_hostname is not supplied, potentially leading to a false sense of security. The issue affects multiple Python versions prior to specific fixed releases. Mitigation does not require patching but involves passing a valid non-empty server_hostname to relevant APIs. The patch changes the behavior to raise a ValueError instead of silently skipping verification.

CVE-2026-19445 is a critical use-after-free vulnerability (CWE-416) in the Python CPython implementation affecting TLS servers that use the sni_callback to assign different SSL contexts per connection without retaining references to the original SSLContext. This can cause server crashes or calls through freed pointers. TLS clients are not affected. The vulnerability impacts multiple CPython versions prior to specific patched releases. Mitigation involves keeping a reference to every SSLContext that sets sni_callback for the server's lifetime.

CVE-2026-12345 is a race condition vulnerability in the cleanup process of tempfile.TemporaryDirectory in CPython. An attacker able to modify the directory tree during cleanup can replace a directory with a symbolic link, leading to deletion or permission changes of files outside the temporary directory with the privileges of the cleanup process. This affects multiple CPython versions prior to fixed releases. The vulnerability is medium severity with a CVSS score of 5.9.

CVE-2026-82049 is a high-severity vulnerability in the tarfile module of CPython 3.13 and earlier. Crafted tar archives containing a hard link to a symbolic link can cause extraction to modify file permissions or modification times outside the intended destination directory, or expose the contents of files outside the extraction tree. This affects multiple CPython versions prior to specific patch releases.

CVE-2026-87910 is a medium severity vulnerability in the Python Software Foundation's CPython implementation related to the tarfile module. When extracting links on systems that do not support links, the filter function is called twice but the return value of one call is ignored, potentially allowing unintended extraction behavior. This issue affects multiple CPython versions prior to specific fixed releases.

CVE-2026-15310 is a low-severity vulnerability in CPython where decompressing specially crafted zip files using bzip, LZMA, or Zstandard compression methods can lead to memory exhaustion. This occurs because Python may use an attacker-controlled size to pre-allocate memory during decompression. The vulnerability affects multiple CPython versions prior to specific patch releases. No known exploits are reported in the wild, and no patch information is provided in the input data.

CVE-2026-19672 is a directory traversal vulnerability in the Python tarfile module affecting POSIX platforms. The issue allows creation of empty directories outside the intended extraction destination when member names contain path components that leave and then return to the destination directory. This does not affect Windows due to path normalization. Only empty directories are created outside the destination; file contents remain inside. The vulnerability affects CPython versions before 3.16.0 and has a medium severity rating with a CVSS score of 6.3.

CVE-2026-15806 is a vulnerability in the Python CPython urllib.request module where HTTPPasswordMgr classes did not consider the URL scheme when matching stored credentials. This caused credentials registered for HTTPS URLs to be sent over HTTP requests to the same host, exposing them to interception if an attacker could redirect or downgrade connections to plain HTTP. The issue is fixed by scoping credential matching to the URL scheme. Users unable to upgrade immediately should avoid making plain HTTP requests to hosts with stored credentials.

CVE-2026-17084 is a medium severity vulnerability in the Python Software Foundation's CPython implementation. The issue lies in the "stringprep" module, which incorrectly processes characters from RFC 3454 tables B.2 and B.3 by using the latest Unicode codepoint attributes instead of those from Unicode 3.2.0. This causes mismatches when handling domain names with the IDNA 2003 "idna" codec and the in_table_b2() function, particularly for domain names containing characters whose Unicode attributes have changed since Unicode 3.2.0.

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory.  This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.