Vulnerability-Lookup

SUSE-SU-2026:20796-1

Vulnerability from csaf_suse - Published: 2026-03-19 12:47 - Updated: 2026-09-20 18:37

Summary

Security update for python311

Severity

Important

Notes

Title of the patch: Security update for python311

Description of the patch: This update for python311 fixes the following issues: Updated to Python 3.11.15: - CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974). - CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029). - CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997). - CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400). - CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401). - CVE-2025-15282: control characters in URL media types data (bsc#1257046). - CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031). - CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042).

Patchnames: SUSE-SLE-Micro-6.0-630

CVE-2025-11468

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2025-12084

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2025-11468

Threats

Impact moderate

CVE-2025-13836

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 12 products, the same list as for CVE-2025-11468

Threats

Impact moderate

CVE-2025-13837

4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2025-11468

Threats

Impact moderate

CVE-2025-15282

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Affected products

Recommended 12 products, the same list as for CVE-2025-11468

Threats

Impact moderate

CVE-2025-6075

2.5 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2025-11468

Threats

Impact low

CVE-2026-0672

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 12 products, the same list as for CVE-2025-11468

Threats

Impact important

CVE-2026-0865

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Affected products

Recommended 12 products, the same list as for CVE-2025-11468

Threats

Impact moderate

References

39 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1252974	self
https://bugzilla.suse.com/1254400	self
https://bugzilla.suse.com/1254401	self
https://bugzilla.suse.com/1254997	self
https://bugzilla.suse.com/1257029	self
https://bugzilla.suse.com/1257031	self
https://bugzilla.suse.com/1257042	self
https://bugzilla.suse.com/1257046	self
https://www.suse.com/security/cve/CVE-2025-11468/	self
https://www.suse.com/security/cve/CVE-2025-12084/	self
https://www.suse.com/security/cve/CVE-2025-13836/	self
https://www.suse.com/security/cve/CVE-2025-13837/	self
https://www.suse.com/security/cve/CVE-2025-15282/	self
https://www.suse.com/security/cve/CVE-2025-6075/	self
https://www.suse.com/security/cve/CVE-2026-0672/	self
https://www.suse.com/security/cve/CVE-2026-0865/	self
https://www.suse.com/security/cve/CVE-2025-11468	external
https://bugzilla.suse.com/1257029	external
https://www.suse.com/security/cve/CVE-2025-12084	external
https://bugzilla.suse.com/1254997	external
https://www.suse.com/security/cve/CVE-2025-13836	external
https://bugzilla.suse.com/1254400	external
https://bugzilla.suse.com/1254997	external
https://www.suse.com/security/cve/CVE-2025-13837	external
https://bugzilla.suse.com/1254401	external
https://bugzilla.suse.com/1254997	external
https://www.suse.com/security/cve/CVE-2025-15282	external
https://bugzilla.suse.com/1257046	external
https://www.suse.com/security/cve/CVE-2025-6075	external
https://bugzilla.suse.com/1252974	external
https://www.suse.com/security/cve/CVE-2026-0672	external
https://bugzilla.suse.com/1257031	external
https://bugzilla.suse.com/1259734	external
https://www.suse.com/security/cve/CVE-2026-0865	external
https://bugzilla.suse.com/1257042	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python311",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python311 fixes the following issues:\n\nUpdated to Python 3.11.15:\n  \n- CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).\n- CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).\n- CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).\n- CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).\n- CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).\n- CVE-2025-15282: control characters in URL media types data (bsc#1257046).\n- CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).\n- CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-630",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20796-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20796-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620796-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20796-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024893.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1252974",
        "url": "https://bugzilla.suse.com/1252974"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1254400",
        "url": "https://bugzilla.suse.com/1254400"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1254401",
        "url": "https://bugzilla.suse.com/1254401"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1254997",
        "url": "https://bugzilla.suse.com/1254997"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257029",
        "url": "https://bugzilla.suse.com/1257029"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257031",
        "url": "https://bugzilla.suse.com/1257031"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257042",
        "url": "https://bugzilla.suse.com/1257042"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257046",
        "url": "https://bugzilla.suse.com/1257046"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-11468 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-11468/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-12084 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-12084/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-13836 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-13836/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-13837 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-13837/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15282 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15282/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6075 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6075/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0672 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0672/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0865 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0865/"
      }
    ],
    "title": "Security update for python311",
    "tracking": {
      "current_release_date": "2026-09-20T18:37:02Z",
      "generator": {
        "date": "2026-03-19T12:47:35Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20796-1",
      "initial_release_date": "2026-03-19T12:47:35Z",
      "revision_history": [
        {
          "date": "2026-03-19T12:47:35Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T18:45:03Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T19:35:35Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T15:32:04Z",
          "number": "4",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-19T15:39:36Z",
          "number": "5",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-20T18:37:02Z",
          "number": "6",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "6"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpython3_11-1_0-0:3.11.15-1.1.aarch64",
                "product": {
                  "name": "libpython3_11-1_0-0:3.11.15-1.1.aarch64",
                  "product_id": "libpython3_11-1_0-0:3.11.15-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libpython3_11-1_0@3.11.15-1.1?arch=aarch64\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python311-0:3.11.15-1.1.aarch64",
                "product": {
                  "name": "python311-0:3.11.15-1.1.aarch64",
                  "product_id": "python311-0:3.11.15-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python311@3.11.15-1.1?arch=aarch64\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python311-base-0:3.11.15-1.1.aarch64",
                "product": {
                  "name": "python311-base-0:3.11.15-1.1.aarch64",
                  "product_id": "python311-base-0:3.11.15-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python311-base@3.11.15-1.1?arch=aarch64\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python311-curses-0:3.11.15-1.1.aarch64",
                "product": {
                  "name": "python311-curses-0:3.11.15-1.1.aarch64",
                  "product_id": "python311-curses-0:3.11.15-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python311-curses@3.11.15-1.1?arch=aarch64\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpython3_11-1_0-0:3.11.15-1.1.s390x",
                "product": {
                  "name": "libpython3_11-1_0-0:3.11.15-1.1.s390x",
                  "product_id": "libpython3_11-1_0-0:3.11.15-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libpython3_11-1_0@3.11.15-1.1?arch=s390x\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python311-0:3.11.15-1.1.s390x",
                "product": {
                  "name": "python311-0:3.11.15-1.1.s390x",
                  "product_id": "python311-0:3.11.15-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python311@3.11.15-1.1?arch=s390x\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python311-base-0:3.11.15-1.1.s390x",
                "product": {
                  "name": "python311-base-0:3.11.15-1.1.s390x",
                  "product_id": "python311-base-0:3.11.15-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python311-base@3.11.15-1.1?arch=s390x\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python311-curses-0:3.11.15-1.1.s390x",
                "product": {
                  "name": "python311-curses-0:3.11.15-1.1.s390x",
                  "product_id": "python311-curses-0:3.11.15-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python311-curses@3.11.15-1.1?arch=s390x\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpython3_11-1_0-0:3.11.15-1.1.x86_64",
                "product": {
                  "name": "libpython3_11-1_0-0:3.11.15-1.1.x86_64",
                  "product_id": "libpython3_11-1_0-0:3.11.15-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libpython3_11-1_0@3.11.15-1.1?arch=x86_64\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python311-0:3.11.15-1.1.x86_64",
                "product": {
                  "name": "python311-0:3.11.15-1.1.x86_64",
                  "product_id": "python311-0:3.11.15-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python311@3.11.15-1.1?arch=x86_64\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python311-base-0:3.11.15-1.1.x86_64",
                "product": {
                  "name": "python311-base-0:3.11.15-1.1.x86_64",
                  "product_id": "python311-base-0:3.11.15-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python311-base@3.11.15-1.1?arch=x86_64\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python311-curses-0:3.11.15-1.1.x86_64",
                "product": {
                  "name": "python311-curses-0:3.11.15-1.1.x86_64",
                  "product_id": "python311-curses-0:3.11.15-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python_software_foundation:cpython:3.11.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python311-curses@3.11.15-1.1?arch=x86_64\u0026upstream=python311-0:3.11.15-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpython3_11-1_0-0:3.11.15-1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64"
        },
        "product_reference": "libpython3_11-1_0-0:3.11.15-1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpython3_11-1_0-0:3.11.15-1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x"
        },
        "product_reference": "libpython3_11-1_0-0:3.11.15-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpython3_11-1_0-0:3.11.15-1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64"
        },
        "product_reference": "libpython3_11-1_0-0:3.11.15-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-0:3.11.15-1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64"
        },
        "product_reference": "python311-0:3.11.15-1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-0:3.11.15-1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x"
        },
        "product_reference": "python311-0:3.11.15-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-0:3.11.15-1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64"
        },
        "product_reference": "python311-0:3.11.15-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-base-0:3.11.15-1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64"
        },
        "product_reference": "python311-base-0:3.11.15-1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-base-0:3.11.15-1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x"
        },
        "product_reference": "python311-base-0:3.11.15-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-base-0:3.11.15-1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64"
        },
        "product_reference": "python311-base-0:3.11.15-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-curses-0:3.11.15-1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64"
        },
        "product_reference": "python311-curses-0:3.11.15-1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-curses-0:3.11.15-1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x"
        },
        "product_reference": "python311-curses-0:3.11.15-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-curses-0:3.11.15-1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
        },
        "product_reference": "python311-curses-0:3.11.15-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-11468",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-11468"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-11468",
          "url": "https://www.suse.com/security/cve/CVE-2025-11468"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257029 for CVE-2025-11468",
          "url": "https://bugzilla.suse.com/1257029"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-19T12:47:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-11468"
    },
    {
      "cve": "CVE-2025-12084",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-12084"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-12084",
          "url": "https://www.suse.com/security/cve/CVE-2025-12084"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254997 for CVE-2025-12084",
          "url": "https://bugzilla.suse.com/1254997"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-19T12:47:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-12084"
    },
    {
      "cve": "CVE-2025-13836",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-13836"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-13836",
          "url": "https://www.suse.com/security/cve/CVE-2025-13836"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254400 for CVE-2025-13836",
          "url": "https://bugzilla.suse.com/1254400"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254997 for CVE-2025-13836",
          "url": "https://bugzilla.suse.com/1254997"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-19T12:47:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-13836"
    },
    {
      "cve": "CVE-2025-13837",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-13837"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-13837",
          "url": "https://www.suse.com/security/cve/CVE-2025-13837"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254401 for CVE-2025-13837",
          "url": "https://bugzilla.suse.com/1254401"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254997 for CVE-2025-13837",
          "url": "https://bugzilla.suse.com/1254997"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-19T12:47:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-13837"
    },
    {
      "cve": "CVE-2025-15282",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15282"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15282",
          "url": "https://www.suse.com/security/cve/CVE-2025-15282"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257046 for CVE-2025-15282",
          "url": "https://bugzilla.suse.com/1257046"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-19T12:47:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15282"
    },
    {
      "cve": "CVE-2025-6075",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6075"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "If the value passed to os.path.expandvars() is user-controlled a \nperformance degradation is possible when expanding environment \nvariables.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6075",
          "url": "https://www.suse.com/security/cve/CVE-2025-6075"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1252974 for CVE-2025-6075",
          "url": "https://bugzilla.suse.com/1252974"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-19T12:47:35Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-6075"
    },
    {
      "cve": "CVE-2026-0672",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0672"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0672",
          "url": "https://www.suse.com/security/cve/CVE-2026-0672"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257031 for CVE-2026-0672",
          "url": "https://bugzilla.suse.com/1257031"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259734 for CVE-2026-0672",
          "url": "https://bugzilla.suse.com/1259734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-19T12:47:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-0672"
    },
    {
      "cve": "CVE-2026-0865",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0865"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
          "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0865",
          "url": "https://www.suse.com/security/cve/CVE-2026-0865"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257042 for CVE-2026-0865",
          "url": "https://bugzilla.suse.com/1257042"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:libpython3_11-1_0-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-base-0:3.11.15-1.1.x86_64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.aarch64",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.s390x",
            "SUSE Linux Micro 6.0:python311-curses-0:3.11.15-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-19T12:47:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-0865"
    }
  ]
}

CVE-2025-11468 (GCVE-0-2025-11468)

Vulnerability from cvelistv5 – Published: 2026-01-20 21:09 – Updated: 2026-03-03 14:41

Title

Folding email comments of unfoldable characters doesn't preserve parenthesis

Summary

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

Severity

5.7 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-21 15:40 UTC

CWE

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Assigner

PSF CNA under the mitre root

CNA scorecard B 80/100 over 28 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/python/cpython/pull/143936	patch
https://github.com/python/cpython/issues/143935	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/17d1490a…	patch
https://github.com/python/cpython/commit/61614a5e…	patch
https://github.com/python/cpython/commit/e9970f07…	patch
https://github.com/python/cpython/commit/f7383868…	patch
https://github.com/python/cpython/commit/a76e4cd6…	patch
https://github.com/python/cpython/commit/003b8315…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.20 (python) Affected: 3.11.0 , < 3.11.15 (python) Affected: 3.12.0 , < 3.12.13 (python) Affected: 3.13.0 , < 3.13.12 (python) Affected: 3.14.0 , < 3.14.3 (python) Affected: 3.15.0a1 , < 3.15.0a6 (python)

Credits

Denis Ledoux Seth Larson Denis Ledoux R. David Murray

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11468",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-21T15:40:23.467208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-93",
                "description": "CWE-93 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-02T17:37:06.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "email"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.20",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.15",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.13",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.12",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.3",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a6",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Denis Ledoux"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Denis Ledoux"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "R. David Murray"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."
            }
          ],
          "value": "When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T14:41:28.324Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/143936"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/143935"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Folding email comments of unfoldable characters doesn\u0027t preserve parenthesis",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-11468",
    "datePublished": "2026-01-20T21:09:11.229Z",
    "dateReserved": "2025-10-07T21:04:42.377Z",
    "dateUpdated": "2026-03-03T14:41:28.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12084 (GCVE-0-2025-12084)

Vulnerability from cvelistv5 – Published: 2025-12-03 18:55 – Updated: 2026-03-03 14:41

Title

Quadratic complexity in node ID cache clearing

Summary

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-03 19:13 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

PSF CNA under the mitre root

CNA scorecard B 80/100 over 28 records in the last 180 days details

References

14 references

URL	Tags
https://github.com/python/cpython/pull/142146	patch
https://github.com/python/cpython/issues/142145	issue-tracking
https://github.com/python/cpython/commit/08d8e18a…	patch
https://github.com/python/cpython/commit/027f21e4…	patch
https://github.com/python/cpython/commit/ddcd2acd…	patch
https://github.com/python/cpython/commit/27648a18…	patch
https://github.com/python/cpython/commit/8d2d7bb2…	patch
https://github.com/python/cpython/commit/9c9dda66…	patch
https://github.com/python/cpython/commit/a696ba8b…	patch
https://github.com/python/cpython/commit/41f46878…	patch
https://github.com/python/cpython/commit/57937a8e…	patch
https://github.com/python/cpython/commit/e91c1144…	patch
https://github.com/python/cpython/commit/a46c10ec…	patch
https://github.com/python/cpython/commit/c97e8759…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.20 (python) Affected: 3.11.0 , < 3.11.15 (python) Affected: 3.12.0 , < 3.12.13 (python) Affected: 3.13.0 , < 3.13.11 (python) Affected: 3.14.0 , < 3.14.2 (python) Affected: 3.15.0a1 , < 3.15.0a3 (python)

Credits

Jacob Walls Shai Berger Natalia Bidart Seth Larson

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12084",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-03T19:13:23.548683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-407",
                "description": "CWE-407 Inefficient Algorithmic Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-03T19:14:59.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.20",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.15",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.13",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.11",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.2",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a3",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jacob Walls"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Shai Berger"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Natalia Bidart"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When building nested elements using \u003ccode\u003exml.dom.minidom\u003c/code\u003e methods such as \u003ccode\u003e\u003ccode\u003eappendChild()\u003c/code\u003e\u003c/code\u003e that have a dependency on \u003ccode\u003e_clear_id_cache()\u003c/code\u003e the algorithm is quadratic. Availability can be impacted when building excessively nested documents."
            }
          ],
          "value": "When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T14:41:38.821Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/142146"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/142145"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Quadratic complexity in node ID cache clearing",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-12084",
    "datePublished": "2025-12-03T18:55:32.222Z",
    "dateReserved": "2025-10-22T16:06:55.078Z",
    "dateUpdated": "2026-03-03T14:41:38.821Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-13836 (GCVE-0-2025-13836)

Vulnerability from cvelistv5 – Published: 2025-12-01 18:02 – Updated: 2026-03-03 14:41

Title

Excessive read buffering DoS in http.client

Summary

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-01 18:32 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

PSF CNA under the mitre root

CNA scorecard B 80/100 over 28 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/python/cpython/issues/119451	issue-tracking
https://github.com/python/cpython/pull/119454	patch
https://github.com/python/cpython/commit/4ce27904…	patch
https://github.com/python/cpython/commit/5a4c4a03…	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/289f29b0…	patch
https://github.com/python/cpython/commit/14b1fdb0…	patch
https://github.com/python/cpython/commit/5dc10167…	patch
https://github.com/python/cpython/commit/afc40bdd…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.20 (python) Affected: 3.11.0 , < 3.11.15 (python) Affected: 3.12.0 , < 3.12.13 (python) Affected: 3.13.0 , < 3.13.11 (python) Affected: 3.14.0 , < 3.14.1 (python) Affected: 3.15.0a1 , < 3.15.0a3 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13836",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-01T18:32:37.506031Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-02T18:29:21.886Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "http.client"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.20",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.15",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.13",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.11",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.1",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a3",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."
            }
          ],
          "value": "When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T14:41:48.702Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/119451"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/119454"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Excessive read buffering DoS in http.client",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-13836",
    "datePublished": "2025-12-01T18:02:38.483Z",
    "dateReserved": "2025-12-01T17:54:40.759Z",
    "dateUpdated": "2026-03-03T14:41:48.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-13837 (GCVE-0-2025-13837)

Vulnerability from cvelistv5 – Published: 2025-12-01 18:13 – Updated: 2026-03-03 14:41

Title

Out-of-memory when loading Plist

Summary

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-01 18:23 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

PSF CNA under the mitre root

CNA scorecard B 80/100 over 28 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/python/cpython/pull/119343	patch
https://github.com/python/cpython/issues/119342	issue-tracking
https://github.com/python/cpython/commit/694922cf…	patch
https://github.com/python/cpython/commit/71fa8eb8…	patch
https://github.com/python/cpython/commit/b64441e4…	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/5a8b1967…	patch
https://github.com/python/cpython/commit/568342cf…	patch
https://github.com/python/cpython/commit/cefee7d1…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.20 (python) Affected: 3.11.0 , < 3.11.15 (python) Affected: 3.12.0 , < 3.12.13 (python) Affected: 3.13.0 , < 3.13.10 (python) Affected: 3.14.0 , < 3.14.1 (python) Affected: 3.15.0a1 , < 3.15.0a3 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13837",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-01T18:23:28.615317Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-07T15:16:47.344Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "plistlib"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.20",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.15",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.13",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.10",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.1",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a3",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues"
            }
          ],
          "value": "When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T14:41:54.597Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/119343"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/119342"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out-of-memory when loading Plist",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-13837",
    "datePublished": "2025-12-01T18:13:32.739Z",
    "dateReserved": "2025-12-01T17:54:41.439Z",
    "dateUpdated": "2026-03-03T14:41:54.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15282 (GCVE-0-2025-15282)

Vulnerability from cvelistv5 – Published: 2026-01-20 21:35 – Updated: 2026-03-03 14:42

Title

Header injection via newlines in data URL mediatype

Summary

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-21 15:40 UTC

CWE

CWE-93

Assigner

PSF CNA under the mitre root

CNA scorecard B 80/100 over 28 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/python/cpython/pull/143926	patch
https://github.com/python/cpython/issues/143925	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/f25509e7…	patch
https://github.com/python/cpython/commit/05356b1c…	patch
https://github.com/python/cpython/commit/34d76b00…	patch
https://github.com/python/cpython/commit/3f396ca9…	patch
https://github.com/python/cpython/commit/4ed11d3c…	patch
https://github.com/python/cpython/commit/a35ca3be…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.20 (python) Affected: 3.11.0 , < 3.11.15 (python) Affected: 3.12.0 , < 3.12.13 (python) Affected: 3.13.0 , < 3.13.12 (python) Affected: 3.14.0 , < 3.14.3 (python) Affected: 3.15.0a1 , < 3.15.0a6 (python)

Credits

Omar M. Hasan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15282",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-21T15:40:21.188269Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-21T16:14:47.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "urllib"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.20",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.15",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.13",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.12",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.3",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a6",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Omar M. Hasan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype."
            }
          ],
          "value": "User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T14:42:00.488Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/143926"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/143925"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Header injection via newlines in data URL mediatype",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-15282",
    "datePublished": "2026-01-20T21:35:13.865Z",
    "dateReserved": "2025-12-29T21:04:54.816Z",
    "dateUpdated": "2026-03-03T14:42:00.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-6075 (GCVE-0-2025-6075)

Vulnerability from cvelistv5 – Published: 2025-10-31 16:41 – Updated: 2026-07-31 14:01

Title

Quadratic complexity in os.path.expandvars() with user-controlled template

Summary

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

Severity

1.8 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-31 17:54 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

PSF CNA under the mitre root

CNA scorecard B 80/100 over 28 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/python/cpython/issues/136065	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/2e6150ad…	patch
https://github.com/python/cpython/commit/631ba340…	patch
https://github.com/python/cpython/commit/892747b4…	patch
https://github.com/python/cpython/commit/9ab89c02…	patch
https://github.com/python/cpython/commit/c8a5f343…	patch
https://github.com/python/cpython/commit/f029e8db…	patch
https://github.com/python/cpython/commit/5dceb934…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.9.25 (python) Affected: 3.10.0 , < 3.10.20 (python) Affected: 3.11.0 , < 3.11.15 (python) Affected: 3.12.0 , < 3.12.13 (python) Affected: 3.13.0 , < 3.13.10 (python) Affected: 3.14.0 , < 3.14.1 (python) Affected: 3.15.0a1 , < 3.15.0a2 (python) cpe:2.3:a:python_software_foundation:cpython::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-31T17:54:46.289107Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-31T17:55:40.240Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.9.25",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.20",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.15",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.13",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.10",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.1",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a2",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.14.0",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eIf the value passed to os.path.expandvars() is user-controlled a \nperformance degradation is possible when expanding environment \nvariables.\u003c/div\u003e"
            }
          ],
          "value": "If the value passed to os.path.expandvars() is user-controlled a \nperformance degradation is possible when expanding environment \nvariables."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 1.8,
            "baseSeverity": "LOW",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T14:01:32.417Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/136065"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5c"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Quadratic complexity in os.path.expandvars() with user-controlled template",
      "x_generator": {
        "engine": "Vulnogram 0.4.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-6075",
    "datePublished": "2025-10-31T16:41:34.983Z",
    "dateReserved": "2025-06-13T15:05:20.139Z",
    "dateUpdated": "2026-07-31T14:01:32.417Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0672 (GCVE-0-2026-0672)

Vulnerability from cvelistv5 – Published: 2026-01-20 21:52 – Updated: 2026-03-03 14:43

Title

Header injection in http.cookies.Morsel

Summary

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-21 15:40 UTC

CWE

CWE-93

Assigner

PSF CNA under the mitre root

CNA scorecard B 80/100 over 28 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/python/cpython/pull/143920	patch
https://github.com/python/cpython/issues/143919	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/95746b3a…	patch
https://github.com/python/cpython/commit/712452e6…	patch
https://github.com/python/cpython/commit/62700107…	patch
https://github.com/python/cpython/commit/7852d72b…	patch
https://github.com/python/cpython/commit/918387e4…	patch
https://github.com/python/cpython/commit/b1869ff6…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.20 (python) Affected: 3.11.0 , < 3.11.15 (python) Affected: 3.12.0 , < 3.12.13 (python) Affected: 3.13.0 , < 3.13.12 (python) Affected: 3.14.0 , < 3.14.3 (python) Affected: 3.15.0a1 , < 3.15.0a6 (python)

Credits

Omar M. Hasan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0672",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-21T15:40:11.672802Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-21T16:14:06.341Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "http.cookies"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.20",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.15",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.13",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.12",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.3",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a6",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Omar M. Hasan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters."
            }
          ],
          "value": "When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T14:43:20.490Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/143920"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/143919"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Header injection in http.cookies.Morsel",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-0672",
    "datePublished": "2026-01-20T21:52:33.925Z",
    "dateReserved": "2026-01-07T17:08:45.326Z",
    "dateUpdated": "2026-03-03T14:43:20.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0865 (GCVE-0-2026-0865)

Vulnerability from cvelistv5 – Published: 2026-01-20 21:26 – Updated: 2026-03-03 14:43

Title

wsgiref.headers.Headers allows header newline injection

Summary

User-controlled header names and values containing newlines can allow injecting HTTP headers.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-21 15:40 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

PSF CNA under the mitre root

CNA scorecard B 80/100 over 28 records in the last 180 days details

References

15 references

URL	Tags
https://github.com/python/cpython/pull/143917	patch
https://github.com/python/cpython/issues/143916	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/22e4d552…	patch
https://github.com/python/cpython/commit/23e3c0ae…	patch
https://github.com/python/cpython/commit/4802b96a…	patch
https://github.com/python/cpython/commit/f7fceed7…	patch
https://github.com/python/cpython/commit/2f840249…	patch
https://github.com/python/cpython/commit/e4846a93…	patch
https://github.com/python/cpython/commit/66da7bf6…	patch
https://github.com/python/cpython/commit/83ecd187…	patch
https://github.com/python/cpython/commit/bfba6600…	patch
https://github.com/python/cpython/commit/286e3ac3…	patch
https://github.com/python/cpython/commit/8bb044d2…	patch
https://github.com/python/cpython/commit/c592227f…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.20 (python) Affected: 3.11.0 , < 3.11.15 (python) Affected: 3.12.0 , < 3.12.13 (python) Affected: 3.13.0 , < 3.13.12 (python) Affected: 3.14.0 , < 3.14.3 (python) Affected: 3.15.0a1 , < 3.15.0a6 (python)

Credits

Omar M. Hasan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0865",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-21T15:40:22.223517Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-21T16:14:52.038Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.20",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.15",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.13",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.12",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.3",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a6",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Omar M. Hasan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "User-controlled header names and values containing newlines can allow injecting HTTP headers."
            }
          ],
          "value": "User-controlled header names and values containing newlines can allow injecting HTTP headers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T14:43:30.596Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/143917"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/143916"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/22e4d55285cee52bc4dbe061324e5f30bd4dee58"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/23e3c0ae867cca0130e441e776c9955b9027c510"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/4802b96a2cde58570c24c13ef3289490980961c5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/f7fceed79ca1bceae8dbe5ba5bc8928564da7211"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e4846a93ac07a8ae9aa18203af0dd13d6e7a6995"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/66da7bf6fe7b81e3ecc9c0a25bd47d4616c8d1a6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/83ecd18779f286d872f68bfce175651e407d9fff"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/bfba660085767f8c2d582134e9d511a85eda04cf"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/286e3ac39984fe85a17f4ab39c64d382137aae5f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/8bb044d29310bb05d15086cdaa8bf64867d61a97"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c592227ffb48679af9845a45dbb0875d975bb219"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "wsgiref.headers.Headers allows header newline injection",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-0865",
    "datePublished": "2026-01-20T21:26:15.274Z",
    "dateReserved": "2026-01-12T16:07:56.781Z",
    "dateUpdated": "2026-03-03T14:43:30.596Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:20796-1

CVE-2025-11468 (GCVE-0-2025-11468)

CVE-2025-12084 (GCVE-0-2025-12084)

CVE-2025-13836 (GCVE-0-2025-13836)

CVE-2025-13837 (GCVE-0-2025-13837)

CVE-2025-15282 (GCVE-0-2025-15282)

CVE-2025-6075 (GCVE-0-2025-6075)

CVE-2026-0672 (GCVE-0-2026-0672)

CVE-2026-0865 (GCVE-0-2026-0865)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour