Summary
It was discovered that Python incorrectly normalized paths in the tarfile
module. An attacker could possibly use this issue to bypass path
restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04
LTS. (CVE-2025-13462)
It was discovered that Python's HTMLParser incorrectly handled certain
malformed HTML input. An attacker could possibly use this issue to cause
Python to crash, resulting in a denial of service. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)
It was discovered that Python's email module incorrectly quoted newlines
in headers. An attacker could possibly use this issue to inject arbitrary
email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu
24.04 LTS. (CVE-2026-1299)
It was discovered that Python's http.client module did not properly
sanitize carriage return and linefeed characters when handling HTTP
CONNECT tunnel request headers. An attacker could possibly use this issue
to inject arbitrary HTTP headers. (CVE-2026-1502)
It was discovered that Python's importlib module did not generate an
audit event when loading legacy .pyc files. An attacker could possibly
use this issue to bypass auditing mechanisms. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)
It was discovered that Python's unicodedata.normalize() function had
incorrect algorithmic complexity. An attacker could possibly use this
issue to cause Python to consume excessive resources, leading to a denial
of service. (CVE-2026-3276)
It was discovered that Python's http.cookies module incorrectly handled
control characters in certain cookie operations. An attacker could possibly
use this issue to inject arbitrary content. This issue only affected Ubuntu
22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)
It was discovered that the Python pyexpat module was vulnerable to
unbounded recursion in the Expat XML parser. An attacker could possibly use
this issue to cause Python to crash, resulting in a denial of service. This
issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)
It was discovered that Python's webbrowser module accepted leading dashes
in URLs, which could be interpreted as command-line options. An attacker
could possibly use this issue to execute arbitrary commands. This issue
only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)
It was discovered that Python incorrectly handled webbrowser.open()
handlers. An attacker could possibly use this issue to execute arbitrary
commands. (CVE-2026-4786)
It was discovered that Python's remote debugging module did not properly
validate offset tables when loading debug information. An attacker could
possibly use this issue to cause Python to crash or execute arbitrary
code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)
It was discovered that Python's http.cookies module incorrectly escaped
values in the js_output() method. An attacker could possibly use this issue
to inject arbitrary JavaScript. (CVE-2026-6019)
It was discovered that Python's lzma, bz2, and gzip decompressor objects
had a use-after-free vulnerability. An attacker could possibly use this
issue to cause Python to crash or execute arbitrary code. (CVE-2026-6100)
It was discovered that Python's tarfile module did not properly validate
link targets when using the data filter. An attacker could possibly use
this issue to bypass path restrictions. This issue only affected Ubuntu
24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)
It was discovered that the fix for CVE-2021-4189 in Python's ftplib module
was incomplete, allowing PASV responses to be used in ftplib.ftpcp(). An
attacker could possibly use this issue to perform server-side request
forgery attacks. (CVE-2026-8328)
It was discovered that Python's bz2 module allowed reuse of a
BZ2Decompressor object after a decompression error. An attacker could
possibly use this issue to cause Python to crash or execute arbitrary
code. (CVE-2026-9669)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | python3.10 | 3.10.12-1~22.04.16 |
| Ubuntu · 24.04 LTS 24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 |
| Ubuntu · 26.04 LTS 26.04:LTS | python3.14 | 3.14.4-1ubuntu0.1 |
Vulnerabilities 18
-
Critical 9.1
Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under …
-
High 8.2
bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out…
-
High 7.5
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParse…
-
High 7.0
webbrowser.open() allows leading dashes in URLs
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
-
High 7.0
Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
-
Medium 6.9
tarfile.data_filter path traversal bypass allows writing outside the extraction directory
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extract…
-
Medium 6.3
Potential DoS via quadratic complexity in unicodedata.normalize()
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
-
Medium 6.0
Header injection in http.cookies.Morsel
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
-
Medium 6.0
email BytesGenerator header injection due to unquoted newlines
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing h…
-
Medium 6.0
Incomplete control character validation in http.cookies
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_o…
-
Medium 6.0
Stack overflow parsing XML with deeply nested DTD content models
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
-
Medium 5.9
FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes…
-
Medium 5.7
HTTP client proxy tunnel headers not validated for CR/LF
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
-
Medium 5.7
SourcelessFileLoader does not use io.open_code()
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
-
Medium 5.3
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The…
-
Medium 5.3
Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a ma…
-
Low 2.1
BaseCookie.js_output() does not neutralize embedded characters
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie …
-
Low 2.0
tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile …
References
-
report
https://ubuntu.com/security/CVE-2021-4189
-
report
https://ubuntu.com/security/CVE-2025-13462
-
report
https://ubuntu.com/security/CVE-2025-69534
-
report
https://ubuntu.com/security/CVE-2026-0672
-
report
https://ubuntu.com/security/CVE-2026-1299
-
report
https://ubuntu.com/security/CVE-2026-1502
-
report
https://ubuntu.com/security/CVE-2026-2297
-
report
https://ubuntu.com/security/CVE-2026-3276
-
report
https://ubuntu.com/security/CVE-2026-3644
-
report
https://ubuntu.com/security/CVE-2026-4224
-
report
https://ubuntu.com/security/CVE-2026-4519
-
report
https://ubuntu.com/security/CVE-2026-4786
-
report
https://ubuntu.com/security/CVE-2026-5713
-
report
https://ubuntu.com/security/CVE-2026-6019
-
report
https://ubuntu.com/security/CVE-2026-6100
-
report
https://ubuntu.com/security/CVE-2026-7774
-
report
https://ubuntu.com/security/CVE-2026-8328
-
report
https://ubuntu.com/security/CVE-2026-9669