Search results

webbrowser: %action substitution can bypass the dash-prefix check

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

type-securityA security issueA security issue

Status: Open.

#148169 In python/cpython;

· StanFromIreland opened on Apr 6, 2026

shutil.unpack_archive() on Windows writes outside extract_dir for ZIP entries with drive-prefixed names

3.10only security fixesonly security fixes

3.11only security fixesonly security fixes

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

3.15new features, bugs and security fixesnew features, bugs and security fixes

OS-windows

stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

type-securityA security issueA security issue

Status: Open.

#146581 In python/cpython;

· PuH4ck3rX opened on Mar 28, 2026

HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF

3.10only security fixesonly security fixes

3.11only security fixesonly security fixes

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

3.15new features, bugs and security fixesnew features, bugs and security fixes

stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

type-securityA security issueA security issue

Status: Open.

#146211 In python/cpython;

· sethmlarson opened on Mar 20, 2026

Upgrade bundled Expat to 2.7.5 (e.g. for the fixes to CVE-2026-3277{6,7,8})

3.12only security fixesonly security fixes

extension-modulesC modules in the Modules dirC modules in the Modules dir

topic-XML

type-securityA security issueA security issue

Status: Open.

#146083 In python/cpython;

· StanFromIreland opened on Mar 17, 2026

pyexpat.c: Unbounded C recursion in conv_content_model causes crash (CVE 2026-4224)

3.12only security fixesonly security fixes

extension-modulesC modules in the Modules dirC modules in the Modules dir

topic-XML

type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

type-securityA security issueA security issue

Status: Open.

#145986 In python/cpython;

· StanFromIreland opened on Mar 15, 2026

[CVE-2026-2297] SourcelessFileLoader does not use io.open_code()

3.10only security fixesonly security fixes

3.11only security fixesonly security fixes

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

3.15new features, bugs and security fixesnew features, bugs and security fixes

stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

topic-importlib

type-securityA security issueA security issue

Status: Open.

#145506 In python/cpython;

· zooba opened on Mar 4, 2026

Potential Quadratic Complexity Vulnerabilities in the email Module

3.10only security fixesonly security fixes

3.11only security fixesonly security fixes

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

3.15new features, bugs and security fixesnew features, bugs and security fixes

stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

topic-email

type-securityA security issueA security issue

Status: Open.

#136063 In python/cpython;

· kexinoh opened on Jun 28, 2025

Clarify the Purpose of the PyGILState API and Identify Better Alternatives

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

docsDocumentation in the Doc dirDocumentation in the Doc dir

topic-C-API

Status: Open.

#131267 In python/cpython;

· ericsnowcurrently opened on Mar 14, 2025

unexpected behavior of datetime.astimezone method

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

extension-modulesC modules in the Modules dirC modules in the Modules dir

stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

Status: Open.

#130718 In python/cpython;

· donbarbos opened on Mar 1, 2025

As of 3.12 _lsprof no longer calls _PyEval_SetProfile making sys.getprofile() useless with cProfile

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

extension-modulesC modules in the Modules dirC modules in the Modules dir

type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

Status: Open.

#130377 In python/cpython;

· sivel opened on Feb 20, 2025

sys.setrecursionlimit no longer affecting pickle.dump

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

extension-modulesC modules in the Modules dirC modules in the Modules dir

type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

Status: Open.

#128590 In python/cpython;

· Jiehong opened on Jan 7, 2025

multiprocessing.Queue: Exceeding a certain amount of bytes in the queue prevents proper exit

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

extension-modulesC modules in the Modules dirC modules in the Modules dir

topic-multiprocessing

type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

Status: Open.

#128186 In python/cpython;

· ebonnal opened on Dec 22, 2024