Security-announce

Download

security-announce@python.org

May 2026

2 participants
2 discussions

[CVE-2026-8328] FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
by Seth Larson May 13, 2026

May 13, 2026

There is a MEDIUM severity vulnerability affecting CPython. The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-8328 * https://github.com/python/cpython/pull/149648

1 0

[CVE-2026-7210] The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
by Stan Ulbrych May 11, 2026

May 11, 2026

There is a MEDIUM severity vulnerability affecting CPython. `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-7210 * https://github.com/python/cpython/pull/149023 Best regards, Stan Ulbrych.

1 0