Cpython CVE-2026-4786

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo

Denial-of-service via quadratic algorithmic complexity in CPython's unicodedata.normalize() affects all CPython versions

Server-Side Request Forgery in CPython's ftplib module allows a malicious FTP source server to redirect a target FTP ser

Privilege escalation in CPython on Windows enables a low-privileged local user to hijack the module search path of a mor

Config file injection in CPython's configparser module allows an attacker who controls multi-line values written via con

CPython's http.cookies.Morsel.js_output() method generates inline script snippets that fail to neutralize the HTML parse