Cpython CVE-2026-6100

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo

Denial-of-service via quadratic algorithmic complexity in CPython's unicodedata.normalize() affects all CPython versions

Server-Side Request Forgery in CPython's ftplib module allows a malicious FTP source server to redirect a target FTP ser

Privilege escalation in CPython on Windows enables a low-privileged local user to hijack the module search path of a mor

Config file injection in CPython's configparser module allows an attacker who controls multi-line values written via con

CPython's http.cookies.Morsel.js_output() method generates inline script snippets that fail to neutralize the HTML parse