CPython imaplib STARTTLS can treat buffered plaintext as TLS
The forwarded notice covers CVE-2026-115559; the snippet gives no versions, fix, or exploitation status.
Stories per day · 30 days
6 RSS
Relatedcpython10brotli5emsign5certifi4certificate-authority4emudhra4node2shell3nodejs3pypi3certificate-validation2claude2cve-2026-891112envoy2infostealer2istio2litellm2memory-corruption2oauth22
64 stories, newest first · one card per story
Stories tagged #python
sqlparse 0.6.1 fixes two flaws as maintainers end the project
A GitHub discussion says a flood of security reports influenced the decision to end sqlparse after this release.
PyPI project pages now show provenance and security warnings
The security tab shows per-file attestations and flags incomplete, inconsistent, changed, or lost provenance before install.
CPython http.cookiejar can delete other domains' cookies
Python rates CVE-2026-124249 medium: an expired Set-Cookie can remove cookies that belong to other domains.
SIExBench tests automated repair of sensitive information exposure
Across 161 verified Python and Java cases, the best of 18 LLM repair setups fixes only 39.1 percent.
CPython sandbox escape zero-day
Python CPython sandbox escape vulnerability threatens AI supply chain; upstream not backporting to security releases.
CPython getaddrinfo accepts embedded null bytes (CVE-2026-116566)
Python's security list rates the socket.getaddrinfo host and port flaw medium; the notice is truncated.
Joern negative reachability misses executed Python functions
In asciinema, 113 of 123 functions Joern called unreachable from entry points still ran; Sublist3r executed 19 of 24.
Brotli decoder flaw CVE-2026-111497 can enable RCE in Node.js and .NET
Public PoCs show memory corruption on unpatched Node.js 24.22.0; no in-the-wild Node2Shell attacks were reported as of publication.
SOCRadar headline says Brotli flaw Node2Shell hits Python packages
The captured page is site navigation, with no CVE, versions, fix, or exploitation details.
Brotli bug CVE-2026-111497 draws patches beyond Node.js
Trail of Bits released an audit tool; Node.js credited OpenAI researchers, and real-world exploitation is not stated.
Python ssl module denylists compromised intermediates (CVE-2026-115557)
The notice says the denylist should protect users even when those certificates are not yet removed elsewhere.
Brotli decoder flaw CVE-2026-111497 can leak memory or run code
Versions 1.0.3 through 1.2.0 are affected; fixed releases include Brotli 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1.
4
Brotli decoder flaw CVE-2026-111497 also hits Node.js, Bun, Python and Envoy
Google rates the memory-corruption bug 9.2; code execution was shown only on one Node.js build, with no attacks reported.
http2shell claimed as RCE in Node, Python, and more
The Hacker News item only shows a title plus 49 points and 10 comments, with no versions or exploit status.
Compromised LiteLLM 1.107.0 steals credentials via Python startup
Starting Python with the package installed can run PRIVCOLLECT without importing LiteLLM; removing the package does not recover credentials.
Python users urged toward truststore after eMudhra CA incident
A short oss-security reply says the CA incident should raise priority for replacing certifi with truststore.
virtualenv 21.14.11 noted for Python users after emSign CA incident
The release vendors pip and requires python-discovery 1.6.1 or newer.
Pillow 13.0.0 fixes critical image-handling flaws, including EPS code execution
CVE-2026-112900 affects Pillow 2.6.0 through 12.3.0 when Ghostscript is installed; none of the flaws is known to be under attack.
Python users urged to prefer system stores after eMudhra CA incident
The reply says distribution pip and requests should use the system certifi store.
CPython tarfile filter bypass writes outside the extraction directory
CVE-2026-114583 was forwarded to oss-security; the body is truncated before versions or a fix.
Python developer urges packages to stop vendoring CA roots
The reply says distribution ca-certificates should be the default, with certifi used as a dependency only when necessary.
Python 3.15.1, 3.14.9 and 3.13.17 are released
The oss-security note only links a Python discussion announcement and does not list changes or CVEs.
Python users pointed to eMudhra emSign CA certificate incident
The forwarded note only cites a Python discussion statement and a comment, without describing the certificate impact.