Threat Intelligence Database

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.

CVE-2026-15310 is a low severity vulnerability in CPython where decompressing specially crafted zip files using bzip, LZMA, or Zstandard compression methods can lead to memory exhaustion. This occurs because Python may use an attacker-controlled size to pre-allocate memory during decompression. The issue affects CPython versions from 0 up to but not including 3.15.0rc2.

CVE-2026-19672 is a directory traversal vulnerability in the Python tarfile module affecting POSIX platforms. The issue allows creation of empty directories outside the intended extraction destination when member names contain path components that leave and then return to the destination directory. This does not affect Windows due to path normalization. Only empty directories are created outside the destination; file contents remain inside. The vulnerability affects CPython versions before 3.16.0 and has a medium severity rating with a CVSS score of 6.3.

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.

CVE-2026-17084 is a vulnerability in the Python Software Foundation's CPython implementation affecting the stringprep module. The module incorrectly processed characters from RFC 3454 tables B.2 and B.3 by using the latest Unicode codepoint attributes instead of those specified in Unicode 3.2.0. This caused mismatches when processing domain names using IDNA 2003, particularly for domain names containing characters with updated Unicode attributes since Unicode 3.2.0. The issue affects CPython versions from 0 up to but not including 3.15.0rc2. The vulnerability has a medium severity with a CVSS score of 6. No known exploits are reported in the wild, and no patch information is provided in the input data.

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.