CPython imaplib STARTTLS can treat buffered plaintext as TLS
The forwarded notice covers CVE-2026-115559; the snippet gives no versions, fix, or exploitation status.
Stories per day · 30 days
4 RSS
Relatedpython10sandbox-escape2tarfile2ai-inference1ai-supply-chain1certificate-validation1cookiejar1cookies1fips1getaddrinfo1gzip1hash-algorithms1http1imaplib1inference-servers1null-byte1path-traversal1software-release1
10 stories, newest first · one card per story
Stories tagged #cpython
CPython http.cookiejar can delete other domains' cookies
Python rates CVE-2026-124249 medium: an expired Set-Cookie can remove cookies that belong to other domains.
CPython sandbox escape zero-day
Python CPython sandbox escape vulnerability threatens AI supply chain; upstream not backporting to security releases.
CPython getaddrinfo accepts embedded null bytes (CVE-2026-116566)
Python's security list rates the socket.getaddrinfo host and port flaw medium; the notice is truncated.
CPython tarfile filter bypass writes outside the extraction directory
CVE-2026-114583 was forwarded to oss-security; the body is truncated before versions or a fix.
Python 3.15.1, 3.14.9 and 3.13.17 are released
The oss-security note only links a Python discussion announcement and does not list changes or CVEs.
CPython [CVE-2026-19445] Use-after-free of a server-side SSLContext when sni_callback switches contexts
CPython CVE-2026-19445 is a critical use-after-free when a server SNI callback switches SSL contexts.
CPython [CVE-2026-12345] Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
CVE-2026-12345 in CPython: race condition in tempfile.TemporaryDirectory cleanup can delete files outside the temporary directory.
Cpython: [CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to symlink
Python discloses CVE-2026-82049: tarfile extraction filters can be bypassed via hard links to symlinks, enabling file modification and content disclosure.
CPython: [CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None
CPython CVE-2026-87910: tarfile's hardlink fallback ignores custom extraction filters that reject entries via None, rated MEDIUM severity.