pkg:Debian/python3.11

All known vulnerabilities

• CRITICAL9.8CVE-2026-7210The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
  from 0
• HIGH7.8CVE-2024-9287Virtual environment (venv) activation scripts don't quote paths
  from 0, < 3.11.2-6+deb12u5
• HIGH7.8CVE-2023-6597python3.7 - security update
  from 0, < 3.11.2-6+deb12u2
• HIGH7.8CVE-2022-42919Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration.
  from 0, < 3.11.0-2
• HIGH7.5CVE-2025-69534Python-Markdown has an Uncaught Exception
  from 0
• HIGH7.5CVE-2025-13836Excessive read buffering DoS in http.client
  from 0, < 3.11.2-6+deb12u7
• HIGH7.5CVE-2025-8194Tarfile infinite loop during parsing with negative member offset
  from 0, < 3.11.2-6+deb12u7
• HIGH7.5CVE-2024-6232Regular-expression DoS when parsing TarFile headers
  from 0, < 3.11.2-6+deb12u4
• HIGH7.5CVE-2024-7592Quadratic complexity parsing cookies with backslashes
  from 0, < 3.11.2-6+deb12u5
• HIGH7.5CVE-2024-4032Incorrect IPv4 and IPv6 private ranges
  from 0, < 3.11.2-6+deb12u3
• HIGH7.5CVE-2023-41105An issue was discovered in Python 3.11 through 3.11.4.
  from 0, < 3.11.2-6+deb12u2
• HIGH7.5CVE-2023-24329pypy3 - security update
  from 0, < 3.11.2-6+deb12u2
• HIGH7.5CVE-2022-45061An issue was discovered in Python before 3.11.1.
  from 0, < 3.11.1-1
• HIGH7.5CVE-2020-10735pypy3 - security update
  from 0, < 3.11.0~rc2-1
• HIGH7.4CVE-2024-0397Memory race condition in ssl.SSLContext certificate store methods
  from 0, < 3.11.2-6+deb12u3
• HIGH7.4CVE-2024-0397Memory race condition in ssl.SSLContext certificate store methods
  from 0, < 3.11.2-6+deb12u3
• HIGH7.4CVE-2021-28861Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginn…
  from 0, < 3.11.0~b4-1
• MEDIUM6.2CVE-2024-0450Quoted zip-bomb protection for zipfile
  from 0, < 3.11.2-6+deb12u2
• MEDIUM6.1CVE-2026-6019BaseCookie.js_output() does not neutralize embedded characters
  from 0
• MEDIUM5.5CVE-2025-13837Out-of-memory when loading Plist
  from 0, < 3.11.2-6+deb12u7
• MEDIUM5.5CVE-2025-6075Quadratic complexity in os.path.expandvars() with user-controlled template
  from 0, < 3.11.2-6+deb12u7
• MEDIUM5.5CVE-2024-6923Email header injection due to unquoted newlines
  from 0, < 3.11.2-6+deb12u5
• MEDIUM5.3CVE-2025-12781base64.b64decode() always accepts "+/" characters, despite setting altchars
  from 0
• MEDIUM5.3CVE-2025-12084Quadratic complexity in node ID cache clearing
  from 0, < 3.11.2-6+deb12u7
• MEDIUM5.3CVE-2023-40217An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5.
  from 0, < 3.11.2-6+deb12u2
• MEDIUM5.3CVE-2023-27043The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character.
  from 0, < 3.11.2-6+deb12u5
• MEDIUM4.3CVE-2025-8291ZIP64 End of Central Directory (EOCD) Locator record offset not checked
  from 0, < 3.11.2-6+deb12u7
• MEDIUM4.3CVE-2025-6069HTMLParser quadratic complexity when processing malformed inputs
  from 0, < 3.11.2-6+deb12u7
• LOW3.3CVE-2026-4519webbrowser.open() allows leading dashes in URLs
  from 0
• —CVE-2026-8328FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
  from 0
• —CVE-2026-6100Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
  from 0
• —CVE-2026-3446Base64 decoding stops at first padded quad by default
  from 0
• —CVE-2026-1502HTTP client proxy tunnel headers not validated for CR/LF
  from 0
• —CVE-2026-3479pkgutil.get_data() does not enforce documented restrictions
  from 0
• —CVE-2026-4224Stack overflow parsing XML with deeply nested DTD content models
  from 0
• —CVE-2026-3644Incomplete control character validation in http.cookies
  from 0
• —CVE-2025-13462tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling
  from 0
• —CVE-2026-2297SourcelessFileLoader does not use io.open_code()
  from 0
• —CVE-2026-1299email BytesGenerator header injection due to unquoted newlines
  from 0, < 3.11.2-6+deb12u7
• —CVE-2026-0865wsgiref.headers.Headers allows header newline injection
  from 0, < 3.11.2-6+deb12u7
• —CVE-2026-0672Header injection in http.cookies.Morsel
  from 0, < 3.11.2-6+deb12u7
• —CVE-2025-15367POP3 command injection in user-controlled commands
  from 0
• —CVE-2025-15366IMAP command injection in user-controlled commands
  from 0
• —CVE-2025-15282Header injection via newlines in data URL mediatype
  from 0, < 3.11.2-6+deb12u7
• —CVE-2025-11468Folding email comments of unfoldable characters doesn't preserve parenthesis
  from 0, < 3.11.2-6+deb12u7
• —CVE-2025-4516Use-after-free in "unicode_escape" decoder with error handler
  from 0, < 3.11.2-6+deb12u7
• —CVE-2025-1795Mishandling of comma during folding and unicode-encoding of email headers
  from 0, < 3.11.2-6+deb12u6
• —CVE-2025-0938URL parser allowed square brackets in domain names
  from 0, < 3.11.2-6+deb12u6
• —CVE-2024-11168Improper validation of IPv6 and IPvFuture addresses
  from 0, < 3.11.2-6+deb12u5
• —CVE-2024-8088Infinite loop when iterating over zip archive entry names from zipfile.Path
  from 0, < 3.11.2-6+deb12u3