Seth Larson

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `stringprep` module incorrectly processes characters from RFC 3454 tables B.2 or B.3 by using the latest Unicode codepoint attributes instead of the required Unicode 3.2.0. This leads to mismatches when processing domain names via the `idna` codec (IDNA 2003) and the `in table b2()` function. The issue specifically impacts domain names containing characters that were either not registered or had their Unicode attributes, such as case-folding behavior, updated after Unicode 3.2.0. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing, leading to significant CPU consumption when applications pass unbounded input to the `csv.Sniffer.sniff()` function. Super-linear regular-expression work refers to a condition where the time taken to process a string increases disproportionately to the length of the input, potentially causing a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, avoid passing unbounded input to the `csv.Sniffer.sniff()` function.

**Name of the Vulnerable Software and Affected Versions** CPython (affected versions not specified) **Description** The incremental HTML parser `html.parser.HTMLParser` contains an issue that allows for CPU denial-of-service when processing uncontrolled data. The root cause is improper input handling that leads to pathological parsing behavior, specifically algorithmic complexity and resource exhaustion, when markup declarations are repeatedly left unterminated. An attacker can exploit this by providing crafted HTML to any service or pipeline using `HTMLParser`, which can result in CPU core exhaustion and the degradation or complete failure of affected applications. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** In the `extract()` function of the Tarfile module, the `filter` parameter is not correctly handled when extracting hardlinks. This issue allows a system extracting content from untrusted tar files to write files with an unexpected uid/gid, even when the user has specified `filter='data'` to restrict the extraction process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** When using the `configparser` module to write configuration files containing multi-line text values with carriage return characters (r), the resulting file could be injected with unexpected keys and values if an attacker controls the written value. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `tarfile.data filter` can be bypassed using crafted link entries, such as symlinks with empty or directory-like names. This allows a malicious tar archive to redirect subsequent archive members outside the intended extraction directory, causing the `tarfile.extractall()` function to write files to arbitrary locations on the system, depending on the permissions of the process performing the extraction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `unicodedata.normalize()` function can consume excessive CPU time when processing specially crafted Unicode input. This occurs when the input contains long sequences of combining characters with alternating Canonical Combining Class values, affecting all normalization forms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pip versions prior to 26.1 **Description** The self-update check functionality runs after installing wheel files, which requires importing well-known Python module names. These imports were deferred to improve the startup time of the pip CLI. This behavior allows newly installed modules to be imported shortly after the installation of a wheel package. **Recommendations** Update to version 26.1 or later. Review package contents prior to installation.

**Name of the Vulnerable Software and Affected Versions** CPython (affected versions not specified) **Description** On Windows, the `shutil.unpack archive()` function fails to properly check for absolute paths within ZIP archives. If an archive contains a path with a drive letter (e.g., `C:`), files may be extracted outside of the intended target directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `js output()` function within `http.cookies.Morsel` returns an inline `<script>` snippet that only escapes double quotes for JavaScript string context. It fails to neutralize the `</script>` sequence, which is sensitive to the HTML parser, allowing for potential escaping within the generated script element. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Base64-encode the cookie value to prevent escaping via the cookie value.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** On Windows systems, the `sock recvfrom into()` function within `asyncio.ProacterEventLoop` lacks a boundary check for the data buffer when the `nbytes` parameter is used. This flaw can lead to an out-of-bounds buffer write if the received network data exceeds the buffer size, potentially resulting in memory corruption, system crashes, or arbitrary code execution. Non-Windows platforms are not affected. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** A use-after-free flaw exists in the decompression modules of Python, specifically within `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This issue occurs when a program re-uses a decompression object after a `MemoryError` is raised due to memory allocation failure, typically during periods of high memory pressure. A use-after-free is a condition where a program continues to use a pointer after it has been freed, which can lead to memory corruption. Exploitation of this flaw could allow an attacker to execute arbitrary code or access sensitive data. The issue is not present when using one-shot decompression helper functions such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()`, as these create a new instance for every call. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, avoid re-using decompressor instances across multiple calls if a `MemoryError` has occurred.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An incomplete mitigation allows for a bypass when a URL contains the string "%action". For certain browser types, this can lead to command injection into the underlying shell via the `webbrowser.open()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified) Description The system does not reject carriage return and line feed (CR/LF) bytes in HTTP client proxy tunnel headers or the host. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** http.cookies.Morsel (affected versions not specified) **Description** User-controlled cookie values and parameters within http.cookies.Morsel can potentially allow the injection of HTTP headers into messages. A patch has been implemented to address this by rejecting all control characters within cookie names, values, and parameters. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Versions prior to 2025-11468 **Description** A flaw exists where parenthesis are not preserved when folding a long comment in an email header containing exclusively unfoldable characters. This can allow for the injection of headers into email messages when addresses are user-controlled and not properly sanitized. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** http.cookies (affected versions not specified) **Description** An incomplete fix for a previous issue related to control character validation in `http.cookies.Morsel` allows control characters to bypass input validation. The fix did not fully address the problem, leaving the `Morsel.update()`, `|= operator`, and unpickling paths vulnerable. Additionally, the `BaseCookie.js output()` function lacks the output validation present in `BaseCookie.output()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CPython (affected versions not specified) **Description** The `webbrowser.open()` API accepted leading dashes in URLs, which could be interpreted as command line options by certain web browsers. This behavior has been modified to reject leading dashes. The issue involves the potential for command execution through crafted URLs passed to the `webbrowser.open()` function. The vulnerable component is the `webbrowser.open()` API endpoint. The vulnerable parameter is the URL passed to the `webbrowser.open()` function. **Recommendations** Sanitize URLs prior to passing them to the `webbrowser.open()` function.

**Name of the Vulnerable Software and Affected Versions** xml.dom.minidom (affected versions not specified) **Description** The software experiences a performance issue when constructing deeply nested XML documents using methods like `appendChild()`. This is due to a quadratic algorithm within the ` clear id cache()` function, which is triggered when building nested elements. This can lead to availability impacts when processing excessively complex documents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python versions prior to 2.3 **Description** The 'zipfile' module does not validate the ZIP64 End of Central Directory (EOCD) Locator record offset value, leading to potential discrepancies in how ZIP archives are handled compared to other ZIP implementations. Specifically, the module incorrectly assumes the ZIP64 EOCD record's location, potentially allowing crafted ZIP archives to be processed in an unexpected manner. **Recommendations** Update to version 2.3 or later.