Vulnerability-Lookup

RHSA-2026:80737

Vulnerability from csaf_redhat - Published: 2026-10-12 11:05 - Updated: 2026-10-19 11:59

Summary

Red Hat Security Advisory: Red Hat AI Base Images 3.3.5 (Spyre)

Severity

Important

Notes

Topic: Red Hat AI Base Images 3.3.5 (Spyre) is now available.

Details: Red Hat® AI Base Images

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-11940

A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-15308

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 3 products, the same list as for CVE-2026-11940

Threats

Impact Important

CVE-2026-64830

A flaw was found in FFmpeg, a widely used multimedia framework. This vulnerability, a heap buffer overflow in the VobSub subtitle demuxer, allows a remote attacker to corrupt memory. By providing a specially crafted subtitle file, an attacker can trigger unbounded writes, which could lead to arbitrary code execution in applications that use FFmpeg's VobSub demuxer. This could allow an attacker to take control of the affected system.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 3 products, the same list as for CVE-2026-11940

Threats

Impact Important

References

32 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:80737	self
https://access.redhat.com/security/cve/CVE-2026-11940	external
https://access.redhat.com/security/cve/CVE-2026-15308	external
https://access.redhat.com/security/cve/CVE-2026-64830	external
https://access.redhat.com/security/updates/classi…	external
https://www.redhat.com/en/products/ai	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-11940	self
https://bugzilla.redhat.com/show_bug.cgi?id=2491848	external
https://www.cve.org/CVERecord?id=CVE-2026-11940	external
https://nvd.nist.gov/vuln/detail/CVE-2026-11940	external
https://github.com/python/cpython/issues/151558	external
https://github.com/python/cpython/pull/151559	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2026-15308	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498608	external
https://www.cve.org/CVERecord?id=CVE-2026-15308	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15308	external
https://github.com/python/cpython/commit/07efb081…	external
https://github.com/python/cpython/commit/7933f4bf…	external
https://github.com/python/cpython/commit/bcf98ddb…	external
https://github.com/python/cpython/commit/e9f92ac0…	external
https://github.com/python/cpython/issues/153030	external
https://github.com/python/cpython/pull/153031	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2026-64830	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506193	external
https://www.cve.org/CVERecord?id=CVE-2026-64830	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64830	external
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd4…	external
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657	external
https://www.vulncheck.com/advisories/ffmpeg-heap-…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Base Images 3.3.5 (Spyre) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat\u00ae AI Base Images",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:80737",
        "url": "https://access.redhat.com/errata/RHSA-2026:80737"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-11940",
        "url": "https://access.redhat.com/security/cve/CVE-2026-11940"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-15308",
        "url": "https://access.redhat.com/security/cve/CVE-2026-15308"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-64830",
        "url": "https://access.redhat.com/security/cve/CVE-2026-64830"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai",
        "url": "https://www.redhat.com/en/products/ai"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80737.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Base Images 3.3.5 (Spyre)",
    "tracking": {
      "current_release_date": "2026-10-19T11:59:06+00:00",
      "generator": {
        "date": "2026-10-19T11:59:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:80737",
      "initial_release_date": "2026-10-12T11:05:14+00:00",
      "revision_history": [
        {
          "date": "2026-10-12T11:05:14+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-12T11:05:20+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-19T11:59:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift AI 3.3",
                "product": {
                  "name": "Red Hat OpenShift AI 3.3",
                  "product_id": "Red Hat OpenShift AI 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_ai:3.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift AI"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
                  "product_id": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-spyre-rhel9@sha256%3A95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900?arch=amd64\u0026repository_url=registry.redhat.io/rhai/base-image-spyre-rhel9\u0026tag=1791231898"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le",
                  "product_id": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-spyre-rhel9@sha256%3Ac2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b?arch=ppc64le\u0026repository_url=registry.redhat.io/rhai/base-image-spyre-rhel9\u0026tag=1791231898"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
                  "product_id": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-spyre-rhel9@sha256%3A7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535?arch=s390x\u0026repository_url=registry.redhat.io/rhai/base-image-spyre-rhel9\u0026tag=1791231898"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x as a component of Red Hat OpenShift AI 3.3",
          "product_id": "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64 as a component of Red Hat OpenShift AI 3.3",
          "product_id": "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le as a component of Red Hat OpenShift AI 3.3",
          "product_id": "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-11940",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-06-23T17:05:33.822236+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491848"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat products that appear in dependency searches under names containing \"tarfile\" but that are not the CPython standard-library tarfile module are not affected by this flaw. Matches such as the Go packages under github.com/containers/image / go.podman.io/image (.../docker/tarfile and .../docker/internal/tarfile) and the Apache Camel artifacts (camel-tarfile, camel-quarkus-tarfile) are unrelated implementations in other languages and do not include the vulnerable CPython tarfile.extractall() filter logic. The separately packaged PyPI component backports-tarfile is also out of scope for this CVE as assigned: it is not the CPython stdlib module named in the advisory and this CVE tracks the interpreter-provided tarfile shipped in Red Hat python3* packages.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11940"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491848",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491848"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11940",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11940"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11940",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11940"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/151558",
          "url": "https://github.com/python/cpython/issues/151558"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/151559",
          "url": "https://github.com/python/cpython/pull/151559"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"
        }
      ],
      "release_date": "2026-06-23T16:04:17.321000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T11:05:14+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:80737",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:80737"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory"
    },
    {
      "cve": "CVE-2026-15308",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-09T18:02:10.090070+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498608"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Python\u0027s `html.parser.HTMLParser` can lead to a denial of service. By supplying specially crafted, malformed HTML with repeated unterminated markup declarations, an attacker can cause excessive CPU consumption, rendering the system unresponsive. Red Hat products utilizing this parser to process untrusted HTML content are susceptible to resource exhaustion.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15308"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498608",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498608"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15308",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15308"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9",
          "url": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced",
          "url": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606",
          "url": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd",
          "url": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/153030",
          "url": "https://github.com/python/cpython/issues/153030"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/153031",
          "url": "https://github.com/python/cpython/pull/153031"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/"
        }
      ],
      "release_date": "2026-07-09T17:10:57.317000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T11:05:14+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:80737",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:80737"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations"
    },
    {
      "cve": "CVE-2026-64830",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-07-22T18:01:30.962327+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506193"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FFmpeg, a widely used multimedia framework. This vulnerability, a heap buffer overflow in the VobSub subtitle demuxer, allows a remote attacker to corrupt memory. By providing a specially crafted subtitle file, an attacker can trigger unbounded writes, which could lead to arbitrary code execution in applications that use FFmpeg\u0027s VobSub demuxer. This could allow an attacker to take control of the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A heap buffer overflow in FFmpeg\u0027s VobSub subtitle demuxer can lead to arbitrary code execution when processing a specially crafted subtitle file. Exploitation requires user interaction, such as opening a malicious media file, which reduces the attack surface but can result in high impact if an affected application processes untrusted content.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-64830"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506193",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506193"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-64830",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64830"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64830",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64830"
        },
        {
          "category": "external",
          "summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951",
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951"
        },
        {
          "category": "external",
          "summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657",
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer",
          "url": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"
        }
      ],
      "release_date": "2026-07-22T16:33:05.724000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T11:05:14+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:80737",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:80737"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing VobSub subtitle files from untrusted or unknown sources. For applications that utilize FFmpeg\u0027s VobSub demuxer, consider running them within a sandboxed environment to restrict the potential impact of a successful exploit.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:7d6c06d260b50a65dfd7bf9ca1643212b5c8e765ec100e211ef7b46f9b302535_s390x",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:95f923a112c10d73ad49dc579022a8744d39906c1b081dc3d96e7a6c2953d900_amd64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c2ad4ad29bce0aa3c3e1d15f3ad8afc913e4ea37c7512dbb571483593f0d235b_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer."
    }
  ]
}

CVE-2026-11940 (GCVE-0-2026-11940)

Vulnerability from cvelistv5 – Published: 2026-06-23 16:04 – Updated: 2026-08-13 00:28

Title

tarfile extraction filter bypass allows escaping the destination directory

Summary

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.

Severity

7.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 17:57 UTC

CWE

Assigner

PSF CNA under the mitre root

CNA scorecard B 80/100 over 27 records in the last 180 days details

References

10 references

URL	Tags
https://github.com/python/cpython/pull/151559	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/issues/151558	issue-tracking
https://github.com/python/cpython/commit/27dd970b…	patch
https://github.com/python/cpython/commit/672825e2…	patch
https://github.com/python/cpython/commit/771d12dd…	patch
https://github.com/python/cpython/commit/79c06bd5…	patch
https://github.com/python/cpython/commit/be13e86f…	patch
https://github.com/python/cpython/commit/e5fdbd8d…	patch
https://github.com/python/cpython/commit/0f852b3f…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.21 (python) Affected: 3.11.0 , < 3.11.16 (python) Affected: 3.12.0 , < 3.12.14 (python) Affected: 3.13.0 , < 3.13.15 (python) Affected: 3.14.0 , < 3.14.7 (python) Affected: 3.15.0a1 , < 3.15.0b4 (python)

Credits

Haruki Oyama (https://github.com/harukioya) Stan Ulbrych (https://github.com/StanFromIreland) Petr Viktorin (https://github.com/encukou)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11940",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:57:25.652265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T17:57:32.525Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.21",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.16",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.14",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.15",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.7",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0b4",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Haruki Oyama (https://github.com/harukioya)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Stan Ulbrych (https://github.com/StanFromIreland)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Petr Viktorin (https://github.com/encukou)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "type": "text/html",
              "value": "\u003cspan\u003etarfile.extractall()\u003c/span\u003e with the \u003cspan\u003e\u0027data\u0027\u003c/span\u003e or \u003cspan\u003e\u0027tar\u0027\u003c/span\u003e\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.\u0026nbsp; \nThe extraction fallback validated the symlink at it\u0027s archived location \nbut recreated it at the hardlink\u0027s shallower\u003cbr\u003epath, letting a relative\n target the filter judged contained escape the destination directory.\u0026nbsp; \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."
            }
          ],
          "value": "tarfile.extractall() with the \u0027data\u0027 or \u0027tar\u0027\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.\u00a0 \nThe extraction fallback validated the symlink at it\u0027s archived location \nbut recreated it at the hardlink\u0027s shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.\u00a0 \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T00:28:51.345Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/151559"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/151558"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "tarfile extraction filter bypass allows escaping the destination directory",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-11940",
    "datePublished": "2026-06-23T16:04:17.321Z",
    "dateReserved": "2026-06-10T19:50:59.923Z",
    "dateUpdated": "2026-08-13T00:28:51.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15308 (GCVE-0-2026-15308)

Vulnerability from cvelistv5 – Published: 2026-07-09 17:10 – Updated: 2026-08-13 00:28

Title

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Summary

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 17:31 UTC

CWE

CWE-400

Assigner

PSF CNA under the mitre root

CNA scorecard B 80/100 over 27 records in the last 180 days details

References

11 references

URL	Tags
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/pull/153031	patch
https://github.com/python/cpython/issues/153030	issue-tracking
https://github.com/python/cpython/commit/07efb081…	patch
https://github.com/python/cpython/commit/7933f4bf…	patch
https://github.com/python/cpython/commit/bcf98ddb…	patch
https://github.com/python/cpython/commit/e9f92ac0…	patch
https://github.com/python/cpython/commit/785df8f7…	patch
https://github.com/python/cpython/commit/1e7956f1…	patch
https://github.com/python/cpython/commit/c2390b93…	patch
http://www.openwall.com/lists/oss-security/2026/07/09/4

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.21 (python) Affected: 3.11.0 , < 3.11.16 (python) Affected: 3.12.0 , < 3.12.14 (python) Affected: 3.13.0 , < 3.13.15 (python) Affected: 3.14.0 , < 3.14.7 (python) Affected: 3.15.0a1 , < 3.15.0b4 (python)

Credits

Edward-x (https://github.com/YLChen-007) Serhiy Storchaka (https://github.com/serhiy-storchaka) Gregory P. Smith (https://github.com/gpshead) Seth Larson (https://github.com/sethmlarson)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15308",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T17:31:19.781935Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T17:31:27.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-09T19:32:36.790Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/09/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "html.parser",
            "html"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.21",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.16",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.14",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.15",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.7",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0b4",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Edward-x (https://github.com/YLChen-007)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Serhiy Storchaka (https://github.com/serhiy-storchaka)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Gregory P. Smith (https://github.com/gpshead)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson (https://github.com/sethmlarson)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."
            }
          ],
          "value": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T00:28:26.690Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/153031"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/153030"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-15308",
    "datePublished": "2026-07-09T17:10:57.317Z",
    "dateReserved": "2026-07-09T17:04:11.926Z",
    "dateUpdated": "2026-08-13T00:28:26.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64830 (GCVE-0-2026-64830)

Vulnerability from cvelistv5 – Published: 2026-07-22 16:33 – Updated: 2026-07-28 01:06 X_Open Source

Title

FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer

Summary

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 17:24 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6759 records in the last 180 days details

References

3 references

URL	Tags
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657	issue-tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd4…	patch
https://www.vulncheck.com/advisories/ffmpeg-heap-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FFmpeg	FFmpeg	Affected: 2.1 , ≤ 8.1.2 (custom) Affected: dbd495f066a85ba96b17433f4306582aa37c3951 (git) cpe:2.3:a:ffmpeg:ffmpeg:::::::: cpe:2.3:a:ffmpeg:ffmpeg::::::::

Date Public

2026-06-30 00:00

Credits

Pavel Kohout, Aisle Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64830",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T17:24:36.081915Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T17:24:45.720Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "FFmpeg",
          "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThanOrEqual": "8.1.2",
              "status": "affected",
              "version": "2.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "dbd495f066a85ba96b17433f4306582aa37c3951",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.1.2",
                  "versionStartIncluding": "2.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pavel Kohout, Aisle Research"
        }
      ],
      "datePublic": "2026-06-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg\u0027s VobSub demuxer."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:06:01.869Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-64830",
    "datePublished": "2026-07-22T16:33:05.724Z",
    "dateReserved": "2026-07-20T18:27:48.161Z",
    "dateUpdated": "2026-07-28T01:06:01.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:80737

CVE-2026-11940 (GCVE-0-2026-11940)

CVE-2026-15308 (GCVE-0-2026-15308)

CVE-2026-64830 (GCVE-0-2026-64830)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour