Summary
It was discovered that Python's http.cookies module incorrectly handled
control characters in certain cookie operations. An attacker could possibly
use this issue to inject arbitrary content. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)
It was discovered that the Python pyexpat module was vulnerable to
unbounded recursion in the Expat XML parser. An attacker could possibly use
this issue to cause Python to crash, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)
It was discovered that Python's tarfile module did not correctly apply the
filter parameter when extracting hard links. An attacker could possibly use
this issue to cause files to be extracted with an unexpected uid or gid,
bypassing the restrictions requested via filter='data'. (CVE-2026-4360)
It was discovered that Python's http.cookies module incorrectly escaped
values in the js_output() method. An attacker could possibly use this issue
to inject arbitrary JavaScript. (CVE-2026-6019)
It was discovered that Python's html.parser module incorrectly handled
repeated unterminated markup declarations. An attacker could possibly use
this issue to cause Python to consume excessive CPU resources, leading to a
denial of service. (CVE-2026-15308)
Fixed packages 17
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | python3.10 | 3.10.12-1~22.04.18 |
| Ubuntu · 24.04 LTS 24.04:LTS | python3.12 | 3.12.3-1ubuntu0.17 |
| Ubuntu · 26.04 LTS 26.04:LTS | python3.14 | 3.14.4-1ubuntu0.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python2.7 | 2.7.6-8ubuntu0.6+esm30 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python3.4 | 3.4.3-1ubuntu1~14.04.7+esm21 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python3.5 | 3.5.2-2ubuntu0~16.04.4~14.04.1+esm11 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python2.7 | 2.7.12-1ubuntu0~16.04.18+esm22 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python3.5 | 3.5.2-2ubuntu0~16.04.13+esm25 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python2.7 | 2.7.17-1~18.04ubuntu1.13+esm15 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.6 | 3.6.9-1~18.04ubuntu1.13+esm10 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.7 | 3.7.5-2ubuntu1~18.04.2+esm11 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.8 | 3.8.0-3ubuntu1~18.04.2+esm11 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python2.7 | 2.7.18-1~20.04.7+esm10 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python3.8 | 3.8.10-0ubuntu1~20.04.18+esm7 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python3.9 | 3.9.5-3ubuntu0~20.04.1+esm11 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python2.7 | 2.7.18-13ubuntu1.5+esm9 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python3.11 | 3.11.0~rc1-1~22.04.1+esm2 |
Vulnerabilities 5
-
High 8.7
Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
-
Medium 6.0
Incomplete control character validation in http.cookies
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_o…
-
Medium 6.0
Stack overflow parsing XML with deeply nested DTD content models
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
-
Low 2.1
BaseCookie.js_output() does not neutralize embedded characters
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie …
-
Low 2.0
Tarfile.extract() doesn't fully respect filter parameter
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='…