{"schema_version":"2","view":"grouped","data":[{"id":76319,"cve_ids":["CVE-2026-15310"],"payload":{"kind":"advisory","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","summary":"When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.","evidence":"osv:BIT-python-2026-15310","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"BIT-python-2026-15310","aliases":["BIT-libpython-2026-15310","BIT-python-2026-15310","BIT-python-min-2026-15310","CVE-2026-15310","PSF-2026-39"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-15310.json"}}],"modified":"2026-10-05T14:30:06.376093848Z","provider":"osv","references":["https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://nvd.nist.gov/vuln/detail/CVE-2026-15310","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Low"}},"related_cves":[{"value":"CVE-2026-15310","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:5098b228-1164-49df-ae4d-ed48c82db31c","priority":{"reasons":[],"severity":"low","linked_cves":[{"cve":"CVE-2026-15310","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15310","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15310","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15310","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15310","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15310","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15310","advisory_id":"5098b228-1164-49df-ae4d-ed48c82db31c","event_types":["advisory"],"published_at":"2026-10-26T22:36:30.008604+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:22.537+00:00","detail_url":"/advisories/advisory%3A5098b228-1164-49df-ae4d-ed48c82db31c","group":{"id":"advisory:5098b228-1164-49df-ae4d-ed48c82db31c","revision":1,"primary_event_id":84127,"change":"published","superseded_by":[],"changed":{"id":84127,"cve_ids":["CVE-2026-15310"],"payload":{"kind":"advisory","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","summary":"When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.","evidence":"osv:BIT-python-2026-15310","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"BIT-python-2026-15310","aliases":["BIT-libpython-2026-15310","BIT-python-2026-15310","BIT-python-min-2026-15310","CVE-2026-15310","PSF-2026-39"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-15310.json"}}],"modified":"2026-10-05T14:30:06.376093848Z","provider":"osv","references":["https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://nvd.nist.gov/vuln/detail/CVE-2026-15310","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Low"}},"related_cves":[{"value":"CVE-2026-15310","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:5098b228-1164-49df-ae4d-ed48c82db31c","priority":{"reasons":[],"severity":"low","linked_cves":[{"cve":"CVE-2026-15310","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15310","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15310","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15310","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15310","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15310","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15310","advisory_id":"5098b228-1164-49df-ae4d-ed48c82db31c","event_types":["advisory"],"published_at":"2026-10-26T22:36:30.008604+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:22.537+00:00","detail_url":"/events/84127"},"members":[{"id":84127,"cve_ids":["CVE-2026-15310"],"payload":{"kind":"advisory","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","summary":"When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.","evidence":"osv:BIT-python-2026-15310","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"BIT-python-2026-15310","aliases":["BIT-libpython-2026-15310","BIT-python-2026-15310","BIT-python-min-2026-15310","CVE-2026-15310","PSF-2026-39"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-15310.json"}}],"modified":"2026-10-05T14:30:06.376093848Z","provider":"osv","references":["https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://nvd.nist.gov/vuln/detail/CVE-2026-15310","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Low"}},"related_cves":[{"value":"CVE-2026-15310","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:5098b228-1164-49df-ae4d-ed48c82db31c","priority":{"reasons":[],"severity":"low","linked_cves":[{"cve":"CVE-2026-15310","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15310","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15310","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15310","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15310","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15310","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15310","advisory_id":"5098b228-1164-49df-ae4d-ed48c82db31c","event_types":["advisory"],"published_at":"2026-10-26T22:36:30.008604+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:22.537+00:00","detail_url":"/events/84127"}]}},{"id":76312,"cve_ids":["CVE-2026-7210"],"payload":{"kind":"advisory","title":"The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection","summary":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.","evidence":"osv:BIT-python-2026-7210","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.16","evidence":"/affected/0/ranges"},{"value":"3.12.14","evidence":"/affected/0/ranges"},{"value":"3.13.14","evidence":"/affected/0/ranges"},{"value":"3.14.6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"BIT-python-2026-7210","aliases":["BIT-libpython-2026-7210","BIT-python-2026-7210","BIT-python-min-2026-7210","CVE-2026-7210","PSF-2026-23"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.16"},{"introduced":"3.12.0"},{"fixed":"3.12.14"},{"introduced":"3.13.0"},{"fixed":"3.13.14"},{"introduced":"3.14.0"},{"fixed":"3.14.6"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-7210.json"}}],"modified":"2026-10-05T14:30:06.237591696Z","provider":"osv","references":["https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","https://nvd.nist.gov/vuln/detail/CVE-2026-7210","https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"High"}},"related_cves":[{"value":"CVE-2026-7210","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:f5f7537d-65c4-4bd7-9c46-a2f56e5cb1b2","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-7210","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-7210","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-7210","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.16","evidence":"/affected/0/ranges"},{"value":"3.12.14","evidence":"/affected/0/ranges"},{"value":"3.13.14","evidence":"/affected/0/ranges"},{"value":"3.14.6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-7210","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-7210","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.16","evidence":"/affected/0/ranges"},{"value":"3.12.14","evidence":"/affected/0/ranges"},{"value":"3.13.14","evidence":"/affected/0/ranges"},{"value":"3.14.6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-7210","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":3,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-7210","advisory_id":"f5f7537d-65c4-4bd7-9c46-a2f56e5cb1b2","event_types":["advisory"],"published_at":"2026-10-26T22:36:26.857336+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-06-05T10:55:22.351+00:00","detail_url":"/advisories/advisory%3Af5f7537d-65c4-4bd7-9c46-a2f56e5cb1b2","group":{"id":"advisory:f5f7537d-65c4-4bd7-9c46-a2f56e5cb1b2","revision":1,"primary_event_id":84180,"change":"published","superseded_by":[],"changed":{"id":84110,"cve_ids":["CVE-2026-7210"],"payload":{"kind":"advisory","title":"The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection","summary":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.","evidence":"osv:BIT-python-2026-7210","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.16","evidence":"/affected/0/ranges"},{"value":"3.12.14","evidence":"/affected/0/ranges"},{"value":"3.13.14","evidence":"/affected/0/ranges"},{"value":"3.14.6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"BIT-python-2026-7210","aliases":["BIT-libpython-2026-7210","BIT-python-2026-7210","BIT-python-min-2026-7210","CVE-2026-7210","PSF-2026-23"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.16"},{"introduced":"3.12.0"},{"fixed":"3.12.14"},{"introduced":"3.13.0"},{"fixed":"3.13.14"},{"introduced":"3.14.0"},{"fixed":"3.14.6"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-7210.json"}}],"modified":"2026-10-05T14:30:06.237591696Z","provider":"osv","references":["https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","https://nvd.nist.gov/vuln/detail/CVE-2026-7210","https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"High"}},"related_cves":[{"value":"CVE-2026-7210","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:f5f7537d-65c4-4bd7-9c46-a2f56e5cb1b2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-7210","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-7210","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-7210","advisory_id":"f5f7537d-65c4-4bd7-9c46-a2f56e5cb1b2","event_types":["advisory"],"published_at":"2026-10-26T22:36:26.857336+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-06-05T10:55:22.351+00:00","detail_url":"/events/84110"},"members":[{"id":84180,"cve_ids":["CVE-2026-7210"],"payload":{"kind":"advisory","title":"The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection","summary":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.","evidence":"osv:BIT-python-2026-7210","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.16","evidence":"/affected/0/ranges"},{"value":"3.12.14","evidence":"/affected/0/ranges"},{"value":"3.13.14","evidence":"/affected/0/ranges"},{"value":"3.14.6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"BIT-python-2026-7210","aliases":["BIT-libpython-2026-7210","BIT-python-2026-7210","BIT-python-min-2026-7210","CVE-2026-7210","PSF-2026-23"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.16"},{"introduced":"3.12.0"},{"fixed":"3.12.14"},{"introduced":"3.13.0"},{"fixed":"3.13.14"},{"introduced":"3.14.0"},{"fixed":"3.14.6"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-7210.json"}}],"modified":"2026-10-05T14:30:06.237591696Z","provider":"osv","references":["https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","https://nvd.nist.gov/vuln/detail/CVE-2026-7210","https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"High"}},"related_cves":[{"value":"CVE-2026-7210","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:f5f7537d-65c4-4bd7-9c46-a2f56e5cb1b2","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-7210","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-7210","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-7210","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.16","evidence":"/affected/0/ranges"},{"value":"3.12.14","evidence":"/affected/0/ranges"},{"value":"3.13.14","evidence":"/affected/0/ranges"},{"value":"3.14.6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-7210","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-7210","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.16","evidence":"/affected/0/ranges"},{"value":"3.12.14","evidence":"/affected/0/ranges"},{"value":"3.13.14","evidence":"/affected/0/ranges"},{"value":"3.14.6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-7210","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":3,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-7210","advisory_id":"f5f7537d-65c4-4bd7-9c46-a2f56e5cb1b2","event_types":["advisory"],"published_at":"2026-10-26T22:38:25.148236+00:00","technologies":["core-osv","python"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-06-05T10:55:22.351+00:00","detail_url":"/events/84180"}]}},{"id":76311,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-python-2026-19672","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-19672.json"}}],"modified":"2026-10-05T14:30:06.225069321Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:27046a86-b0af-421d-ae8c-92919a385cd5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","advisory_id":"27046a86-b0af-421d-ae8c-92919a385cd5","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T12:57:48.991+00:00","detail_url":"/advisories/advisory%3A27046a86-b0af-421d-ae8c-92919a385cd5","group":{"id":"advisory:27046a86-b0af-421d-ae8c-92919a385cd5","revision":1,"primary_event_id":84096,"change":"published","superseded_by":[],"changed":{"id":84096,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-python-2026-19672","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-19672.json"}}],"modified":"2026-10-05T14:30:06.225069321Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:27046a86-b0af-421d-ae8c-92919a385cd5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","advisory_id":"27046a86-b0af-421d-ae8c-92919a385cd5","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T12:57:48.991+00:00","detail_url":"/events/84096"},"members":[{"id":84096,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-python-2026-19672","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-19672.json"}}],"modified":"2026-10-05T14:30:06.225069321Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:27046a86-b0af-421d-ae8c-92919a385cd5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","advisory_id":"27046a86-b0af-421d-ae8c-92919a385cd5","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T12:57:48.991+00:00","detail_url":"/events/84096"}]}},{"id":76310,"cve_ids":["CVE-2026-17084"],"payload":{"kind":"advisory","title":"stringprep.map_table_b2() deviates from RFC 3454 Table B.2","summary":"The \"stringprep\" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the \"idna\" codec) and the in_table_b2() function of the \"stringprep\" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.","evidence":"osv:BIT-python-2026-17084","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-17084","aliases":["BIT-libpython-2026-17084","BIT-python-2026-17084","BIT-python-min-2026-17084","CVE-2026-17084","PSF-2026-37"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-17084.json"}}],"modified":"2026-10-05T14:30:06.075890190Z","provider":"osv","references":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","https://nvd.nist.gov/vuln/detail/CVE-2026-17084","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-17084","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:2146ce21-32a8-478b-a2b1-006eba857cef","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-17084","advisory_id":"2146ce21-32a8-478b-a2b1-006eba857cef","event_types":["advisory"],"published_at":"2026-10-26T22:36:24.622257+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:25.239+00:00","detail_url":"/advisories/advisory%3A2146ce21-32a8-478b-a2b1-006eba857cef","group":{"id":"advisory:2146ce21-32a8-478b-a2b1-006eba857cef","revision":1,"primary_event_id":84120,"change":"published","superseded_by":[],"changed":{"id":84089,"cve_ids":["CVE-2026-17084"],"payload":{"kind":"advisory","title":"stringprep.map_table_b2() deviates from RFC 3454 Table B.2","summary":"The \"stringprep\" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the \"idna\" codec) and the in_table_b2() function of the \"stringprep\" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.","evidence":"osv:BIT-python-2026-17084","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-17084","aliases":["BIT-libpython-2026-17084","BIT-python-2026-17084","BIT-python-min-2026-17084","CVE-2026-17084","PSF-2026-37"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-17084.json"}}],"modified":"2026-10-05T14:30:06.075890190Z","provider":"osv","references":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","https://nvd.nist.gov/vuln/detail/CVE-2026-17084","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-17084","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:2146ce21-32a8-478b-a2b1-006eba857cef","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-17084","advisory_id":"2146ce21-32a8-478b-a2b1-006eba857cef","event_types":["advisory"],"published_at":"2026-10-26T22:36:24.622257+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:25.239+00:00","detail_url":"/events/84089"},"members":[{"id":84120,"cve_ids":["CVE-2026-17084"],"payload":{"kind":"advisory","title":"stringprep.map_table_b2() deviates from RFC 3454 Table B.2","summary":"The \"stringprep\" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the \"idna\" codec) and the in_table_b2() function of the \"stringprep\" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.","evidence":"osv:BIT-python-2026-17084","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-17084","aliases":["BIT-libpython-2026-17084","BIT-python-2026-17084","BIT-python-min-2026-17084","CVE-2026-17084","PSF-2026-37"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-17084.json"}}],"modified":"2026-10-05T14:30:06.075890190Z","provider":"osv","references":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","https://nvd.nist.gov/vuln/detail/CVE-2026-17084","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-17084","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:2146ce21-32a8-478b-a2b1-006eba857cef","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-17084","advisory_id":"2146ce21-32a8-478b-a2b1-006eba857cef","event_types":["advisory"],"published_at":"2026-10-26T22:36:29.044416+00:00","technologies":["core-osv","python"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:25.239+00:00","detail_url":"/events/84120"}]}},{"id":76309,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-python-2026-15806","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-15806.json"}}],"modified":"2026-10-05T14:30:06.074695860Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:dca624c8-1a66-435a-aec2-aee958e8a027","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":3,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","advisory_id":"dca624c8-1a66-435a-aec2-aee958e8a027","event_types":["advisory"],"published_at":"2026-10-26T22:36:23.462915+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:23.9+00:00","detail_url":"/advisories/advisory%3Adca624c8-1a66-435a-aec2-aee958e8a027","group":{"id":"advisory:dca624c8-1a66-435a-aec2-aee958e8a027","revision":1,"primary_event_id":84213,"change":"published","superseded_by":[],"changed":{"id":84082,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-python-2026-15806","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-15806.json"}}],"modified":"2026-10-05T14:30:06.074695860Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:dca624c8-1a66-435a-aec2-aee958e8a027","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","advisory_id":"dca624c8-1a66-435a-aec2-aee958e8a027","event_types":["advisory"],"published_at":"2026-10-26T22:36:23.462915+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:23.9+00:00","detail_url":"/events/84082"},"members":[{"id":84213,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-python-2026-15806","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-15806.json"}}],"modified":"2026-10-05T14:30:06.074695860Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:dca624c8-1a66-435a-aec2-aee958e8a027","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":3,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","advisory_id":"dca624c8-1a66-435a-aec2-aee958e8a027","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","python"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:23.9+00:00","detail_url":"/events/84213"}]}},{"id":76308,"cve_ids":["CVE-2026-87910"],"payload":{"kind":"advisory","title":"tarfile hardlink fallback ignores custom extraction filter rejection via None","summary":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.","evidence":"osv:BIT-python-2026-87910","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-87910","aliases":["BIT-libpython-2026-87910","BIT-python-2026-87910","BIT-python-min-2026-87910","CVE-2026-87910","PSF-2026-40"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-87910.json"}}],"modified":"2026-10-05T14:30:06.073743911Z","provider":"osv","references":["https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","https://nvd.nist.gov/vuln/detail/CVE-2026-87910","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-87910","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:14fbec69-1894-474e-aff9-7c4f885a6007","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-87910","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-87910","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-87910","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-87910","advisory_id":"14fbec69-1894-474e-aff9-7c4f885a6007","event_types":["advisory"],"published_at":"2026-10-26T22:36:22.439951+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T11:54:23.295+00:00","detail_url":"/advisories/advisory%3A14fbec69-1894-474e-aff9-7c4f885a6007","group":{"id":"advisory:14fbec69-1894-474e-aff9-7c4f885a6007","revision":1,"primary_event_id":84068,"change":"published","superseded_by":[],"changed":{"id":84068,"cve_ids":["CVE-2026-87910"],"payload":{"kind":"advisory","title":"tarfile hardlink fallback ignores custom extraction filter rejection via None","summary":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.","evidence":"osv:BIT-python-2026-87910","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-87910","aliases":["BIT-libpython-2026-87910","BIT-python-2026-87910","BIT-python-min-2026-87910","CVE-2026-87910","PSF-2026-40"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-87910.json"}}],"modified":"2026-10-05T14:30:06.073743911Z","provider":"osv","references":["https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","https://nvd.nist.gov/vuln/detail/CVE-2026-87910","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-87910","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:14fbec69-1894-474e-aff9-7c4f885a6007","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-87910","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-87910","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-87910","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-87910","advisory_id":"14fbec69-1894-474e-aff9-7c4f885a6007","event_types":["advisory"],"published_at":"2026-10-26T22:36:22.439951+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T11:54:23.295+00:00","detail_url":"/events/84068"},"members":[{"id":84068,"cve_ids":["CVE-2026-87910"],"payload":{"kind":"advisory","title":"tarfile hardlink fallback ignores custom extraction filter rejection via None","summary":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.","evidence":"osv:BIT-python-2026-87910","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-87910","aliases":["BIT-libpython-2026-87910","BIT-python-2026-87910","BIT-python-min-2026-87910","CVE-2026-87910","PSF-2026-40"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-87910.json"}}],"modified":"2026-10-05T14:30:06.073743911Z","provider":"osv","references":["https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","https://nvd.nist.gov/vuln/detail/CVE-2026-87910","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-87910","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:14fbec69-1894-474e-aff9-7c4f885a6007","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-87910","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-87910","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-87910","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-87910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-87910","advisory_id":"14fbec69-1894-474e-aff9-7c4f885a6007","event_types":["advisory"],"published_at":"2026-10-26T22:36:22.439951+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T11:54:23.295+00:00","detail_url":"/events/84068"}]}},{"id":67655,"cve_ids":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"payload":{"kind":"advisory","title":"Security update for python","summary":"This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227). Changes for python: - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)","evidence":"osv:SUSE-SU-2026:4411-1","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4411-1","aliases":["SUSE-SU-2026:4411-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python","purl":"pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python-base","purl":"pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}}],"modified":"2026-10-02T11:30:04.071737814Z","provider":"osv","upstream":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264411-1/","https://bugzilla.suse.com/1267974","https://bugzilla.suse.com/1273148","https://bugzilla.suse.com/1274683","https://bugzilla.suse.com/1276223","https://bugzilla.suse.com/1276226","https://bugzilla.suse.com/1276227","https://bugzilla.suse.com/1276903","https://www.suse.com/security/cve/CVE-2026-15806","https://www.suse.com/security/cve/CVE-2026-17084","https://www.suse.com/security/cve/CVE-2026-18503","https://www.suse.com/security/cve/CVE-2026-19672","https://www.suse.com/security/cve/CVE-2026-6879","https://www.suse.com/security/cve/CVE-2026-9669"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"},{"value":"CVE-2026-17084","evidence":"/upstream"},{"value":"CVE-2026-18503","evidence":"/upstream"},{"value":"CVE-2026-19672","evidence":"/upstream"},{"value":"CVE-2026-6879","evidence":"/upstream"},{"value":"CVE-2026-9669","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-18503","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":10,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4411-1","advisory_id":"38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","event_types":["advisory"],"published_at":"2026-10-25T21:20:20.94062+00:00","technologies":["core-osv","python","python-base"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:38:59+00:00","detail_url":"/advisories/advisory%3A38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","group":{"id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","revision":1,"primary_event_id":84219,"change":"published","superseded_by":[],"changed":{"id":68025,"cve_ids":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"payload":{"kind":"advisory","title":"Security update for python","summary":"This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227). Changes for python: - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)","evidence":"osv:SUSE-SU-2026:4411-1","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4411-1","aliases":["SUSE-SU-2026:4411-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python","purl":"pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python-base","purl":"pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}}],"modified":"2026-10-02T11:30:04.071737814Z","provider":"osv","upstream":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264411-1/","https://bugzilla.suse.com/1267974","https://bugzilla.suse.com/1273148","https://bugzilla.suse.com/1274683","https://bugzilla.suse.com/1276223","https://bugzilla.suse.com/1276226","https://bugzilla.suse.com/1276227","https://bugzilla.suse.com/1276903","https://www.suse.com/security/cve/CVE-2026-15806","https://www.suse.com/security/cve/CVE-2026-17084","https://www.suse.com/security/cve/CVE-2026-18503","https://www.suse.com/security/cve/CVE-2026-19672","https://www.suse.com/security/cve/CVE-2026-6879","https://www.suse.com/security/cve/CVE-2026-9669"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"},{"value":"CVE-2026-17084","evidence":"/upstream"},{"value":"CVE-2026-18503","evidence":"/upstream"},{"value":"CVE-2026-19672","evidence":"/upstream"},{"value":"CVE-2026-6879","evidence":"/upstream"},{"value":"CVE-2026-9669","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-18503","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4411-1","advisory_id":"38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","event_types":["advisory"],"published_at":"2026-10-25T21:20:20.94062+00:00","technologies":["core-osv","python","python-base"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:38:59+00:00","detail_url":"/events/68025"},"members":[{"id":84219,"cve_ids":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"payload":{"kind":"advisory","title":"Security update for python","summary":"This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227). Changes for python: - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)","evidence":"osv:SUSE-SU-2026:4411-1","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4411-1","aliases":["SUSE-SU-2026:4411-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python","purl":"pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python-base","purl":"pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}}],"modified":"2026-10-02T11:30:04.071737814Z","provider":"osv","upstream":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264411-1/","https://bugzilla.suse.com/1267974","https://bugzilla.suse.com/1273148","https://bugzilla.suse.com/1274683","https://bugzilla.suse.com/1276223","https://bugzilla.suse.com/1276226","https://bugzilla.suse.com/1276227","https://bugzilla.suse.com/1276903","https://www.suse.com/security/cve/CVE-2026-15806","https://www.suse.com/security/cve/CVE-2026-17084","https://www.suse.com/security/cve/CVE-2026-18503","https://www.suse.com/security/cve/CVE-2026-19672","https://www.suse.com/security/cve/CVE-2026-6879","https://www.suse.com/security/cve/CVE-2026-9669"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"},{"value":"CVE-2026-17084","evidence":"/upstream"},{"value":"CVE-2026-18503","evidence":"/upstream"},{"value":"CVE-2026-19672","evidence":"/upstream"},{"value":"CVE-2026-6879","evidence":"/upstream"},{"value":"CVE-2026-9669","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-18503","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":10,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4411-1","advisory_id":"38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","python","python-base"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-01T15:38:59+00:00","detail_url":"/events/84219"}]}}],"next_after":76319,"next_before":67655}