Search results

[3.13] gh-90309: Base64-encode cookie values embedded in JS

awaiting review

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 148888

#148888 In python/cpython;

· miss-islington opened on Apr 22, 2026

[3.12] gh-148808: Add boundary check to asyncio.AbstractEventLoop.sock_recvf… (GH-148809)

awaiting merge

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 148835

#148835 In python/cpython;

· miss-islington opened on Apr 21, 2026

[3.11] gh-148808: Add boundary check to asyncio.AbstractEventLoop.sock_recvf… (GH-148809)

awaiting review

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 148834

#148834 In python/cpython;

· miss-islington opened on Apr 21, 2026

asyncio.AbstractEventLoop.sock_recvfrom_into() on Windows doesn't check buffer length

extension-modulesC modules in the Modules dirC modules in the Modules dir

OS-windows

topic-asyncio

type-securityA security issueA security issue

Status: Open.

#148808 In python/cpython;

· sethmlarson opened on Apr 20, 2026

[CVE-2026-6100] Possible UAF in {LZMA,BZ2,_Zlib}Decompressor

extension-modulesC modules in the Modules dirC modules in the Modules dir

type-securityA security issueA security issue

Status: Open.

#148395 In python/cpython;

· StanFromIreland opened on Apr 11, 2026

[3.11] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146…

awaiting review

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 148351

#148351 In python/cpython;

· sethmlarson opened on Apr 10, 2026

[3.10] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146…

awaiting review

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 148350

#148350 In python/cpython;

· sethmlarson opened on Apr 10, 2026

[3.13] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)

awaiting review

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 148343

#148343 In python/cpython;

· miss-islington opened on Apr 10, 2026

[3.12] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)

awaiting review

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 148341

#148341 In python/cpython;

· miss-islington opened on Apr 10, 2026

webbrowser: %action substitution can bypass the dash-prefix check

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

type-securityA security issueA security issue

Status: Open.

#148169 In python/cpython;

· StanFromIreland opened on Apr 6, 2026

gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows

awaiting merge

needs backport to 3.10only security fixesonly security fixes

needs backport to 3.11only security fixesonly security fixes

needs backport to 3.12only security fixesonly security fixes

needs backport to 3.13bugs and security fixesbugs and security fixes

needs backport to 3.14bugs and security fixesbugs and security fixes

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 146591

#146591 In python/cpython;

· serhiy-storchaka opened on Mar 29, 2026

shutil.unpack_archive() on Windows writes outside extract_dir for ZIP entries with drive-prefixed names

3.10only security fixesonly security fixes

3.11only security fixesonly security fixes

3.12only security fixesonly security fixes

3.13bugs and security fixesbugs and security fixes

3.14bugs and security fixesbugs and security fixes

3.15new features, bugs and security fixesnew features, bugs and security fixes

OS-windows

stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

type-securityA security issueA security issue

Status: Open.

#146581 In python/cpython;

· PuH4ck3rX opened on Mar 28, 2026