Fix CVE(s): CVE-2025-13462, CVE-2026-3644, CVE-2026-4224, CVE-2026-7210
* SECURITY UPDATE: tarfile AREGTYPE->DIRTYPE misnormalization of multi-block member headers - debian/patches/CVE-2025-13462.patch: in Lib/tarfile.py, add a dircheck flag to frombuf()/fromtarfile() and read the follow-up header of GNU long-name and PAX multi-block members with dircheck=False in _proc_gnulong()/_proc_pax(), so the old-V7 "AREGTYPE name ending in / is a directory" normalization is no longer applied to a follow-up header based on its truncated name. Prevents a crafted tar archive from being interpreted differently by tarfile than by other tools. Backport of upstream commit 42d754e34c (gh-141707), the same fix shipped by Debian in DLA-4583-1; applies to 3.7.3 without code changes (the affected functions are structurally identical). Bundles the upstream regression test test_longname_file_not_directory (test_tarfile.py). - CVE-2025-13462 * SECURITY UPDATE: C stack overflow in pyexpat via deeply nested DTD content model - debian/patches/CVE-2026-4224.patch: guard the recursion in Modules/pyexpat.c conv_content_model() with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() so a deeply nested inline DTD content model parsed by an Expat parser with a registered ElementDeclHandler raises RecursionError instead of crashing the interpreter. Adapted from upstream commit eb0e8be3a7 (gh-145986); upstream uses the private _Py_EnterRecursiveCall() API, replaced here with the equivalent public 3.7 macros. The upstream regression test is not bundled (it needs 3.7-absent test.suppor
- Products
- idle-python3.7, libpython3.7, libpython3.7-dev, libpython3.7-minimal, libpython3.7-stdlib, libpython3.7-testsuite, python3.7, python3.7-dev, python3.7-doc, python3.7-examples, python3.7-minimal, python3.7-venv
- Affected versions
- Not specified
- Fixed versions
- 3.7.3-2+deb10u7+tuxcare.els5
- CVEs
- CVE-2025-13462, CVE-2026-0672, CVE-2026-3644, CVE-2026-4224, CVE-2026-7210
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:45 UTC · Revision 1
Source evidence
Fix CVE(s): CVE-2025-13462, CVE-2026-3644, CVE-2026-4224, CVE-2026-7210
core-osv · Original sourcePublished 12 Jun 2026, 10:27 UTC
* SECURITY UPDATE: tarfile AREGTYPE->DIRTYPE misnormalization of multi-block member headers - debian/patches/CVE-2025-13462.patch: in Lib/tarfile.py, add a dircheck flag to frombuf()/fromtarfile() and read the follow-up header of GNU long-name and PAX multi-block members with dircheck=False in _proc_gnulong()/_proc_pax(), so the old-V7 "AREGTYPE name ending in / is a directory" normalization is no longer applied to a follow-up header based on its truncated name. Prevents a crafted tar archive from being interpreted differently by tarfile than by other tools. Backport of upstream commit 42d754e34c (gh-141707), the same fix shipped by Debian in DLA-4583-1; applies to 3.7.3 without code changes (the affected functions are structurally identical). Bundles the upstream regression test test_longname_file_not_directory (test_tarfile.py). - CVE-2025-13462 * SECURITY UPDATE: C stack overflow in pyexpat via deeply nested DTD content model - debian/patches/CVE-2026-4224.patch: guard the recursion in Modules/pyexpat.c conv_content_model() with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() so a deeply nested inline DTD content model parsed by an Expat parser with a registered ElementDeclHandler raises RecursionError instead of crashing the interpreter. Adapted from upstream commit eb0e8be3a7 (gh-145986); upstream uses the private _Py_EnterRecursiveCall() API, replaced here with the equivalent public 3.7 macros. The upstream regression test is not bundled (it needs 3.7-absent test.suppor
osv:CLSA-2026-1781259901
idle-python3.7
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
libpython3.7
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
libpython3.7-dev
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
libpython3.7-minimal
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
libpython3.7-stdlib
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
libpython3.7-testsuite
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
python3.7
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
python3.7-dev
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
python3.7-doc
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
python3.7-examples
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
python3.7-minimal
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
python3.7-venv
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els5
Complete source record
{
"id": "719e66eb32c4b4870e6f09b93fdaf4a86b83e729239879af244d5e721693c016",
"url": "https://osv.dev/vulnerability/CLSA-2026-1781259901",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fix CVE(s): CVE-2025-13462, CVE-2026-3644, CVE-2026-4224, CVE-2026-7210",
"summary": "* SECURITY UPDATE: tarfile AREGTYPE->DIRTYPE misnormalization of multi-block member headers - debian/patches/CVE-2025-13462.patch: in Lib/tarfile.py, add a dircheck flag to frombuf()/fromtarfile() and read the follow-up header of GNU long-name and PAX multi-block members with dircheck=False in _proc_gnulong()/_proc_pax(), so the old-V7 \"AREGTYPE name ending in / is a directory\" normalization is no longer applied to a follow-up header based on its truncated name. Prevents a crafted tar archive from being interpreted differently by tarfile than by other tools. Backport of upstream commit 42d754e34c (gh-141707), the same fix shipped by Debian in DLA-4583-1; applies to 3.7.3 without code changes (the affected functions are structurally identical). Bundles the upstream regression test test_longname_file_not_directory (test_tarfile.py). - CVE-2025-13462 * SECURITY UPDATE: C stack overflow in pyexpat via deeply nested DTD content model - debian/patches/CVE-2026-4224.patch: guard the recursion in Modules/pyexpat.c conv_content_model() with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() so a deeply nested inline DTD content model parsed by an Expat parser with a registered ElementDeclHandler raises RecursionError instead of crashing the interpreter. Adapted from upstream commit eb0e8be3a7 (gh-145986); upstream uses the private _Py_EnterRecursiveCall() API, replaced here with the equivalent public 3.7 macros. The upstream regression test is not bundled (it needs 3.7-absent test.suppor",
"evidence": "osv:CLSA-2026-1781259901",
"products": [
{
"name": {
"value": "idle-python3.7",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-dev",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-minimal",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-stdlib",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-testsuite",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-dev",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-doc",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-examples",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-minimal",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-venv",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els5",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1781259901",
"aliases": [
"CLSA-2026-1781259901"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "idle-python3.7",
"purl": "pkg:deb/tuxcare/idle-python3.7?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "libpython3.7",
"purl": "pkg:deb/tuxcare/libpython3.7?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "libpython3.7-dev",
"purl": "pkg:deb/tuxcare/libpython3.7-dev?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "libpython3.7-minimal",
"purl": "pkg:deb/tuxcare/libpython3.7-minimal?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "libpython3.7-stdlib",
"purl": "pkg:deb/tuxcare/libpython3.7-stdlib?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "libpython3.7-testsuite",
"purl": "pkg:deb/tuxcare/libpython3.7-testsuite?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "python3.7",
"purl": "pkg:deb/tuxcare/python3.7?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "python3.7-dev",
"purl": "pkg:deb/tuxcare/python3.7-dev?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "python3.7-doc",
"purl": "pkg:deb/tuxcare/python3.7-doc?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "python3.7-examples",
"purl": "pkg:deb/tuxcare/python3.7-examples?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "python3.7-minimal",
"purl": "pkg:deb/tuxcare/python3.7-minimal?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els5"
}
]
}
],
"package": {
"name": "python3.7-venv",
"purl": "pkg:deb/tuxcare/python3.7-venv?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1781259901.json"
}
}
],
"modified": "2026-10-26T09:43:11.830049500Z",
"provider": "osv",
"upstream": [
"CVE-2025-13462",
"CVE-2026-0672",
"CVE-2026-3644",
"CVE-2026-4224",
"CVE-2026-7210"
],
"references": [
"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1781259901.html",
"https://nvd.nist.gov/vuln/detail/CVE-2025-13462",
"https://nvd.nist.gov/vuln/detail/CVE-2026-3644",
"https://nvd.nist.gov/vuln/detail/CVE-2026-4224",
"https://nvd.nist.gov/vuln/detail/CVE-2026-7210"
]
},
"related_cves": [
{
"value": "CVE-2025-13462",
"evidence": "/upstream"
},
{
"value": "CVE-2026-0672",
"evidence": "/upstream"
},
{
"value": "CVE-2026-3644",
"evidence": "/upstream"
},
{
"value": "CVE-2026-4224",
"evidence": "/upstream"
},
{
"value": "CVE-2026-7210",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 449747,
"published_at": "2026-06-12T10:27:16+00:00"
}