Mailman 3 August 2026 - Security-announce

[CVE-2026-15310] Memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression
by Petr Viktorin Aug. 25, 2026

Aug. 25, 2026

There is a LOW severity vulnerability affecting CPython. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-15310 * https://github.com/python/cpython/pull/156003

1 0

[CVE-2026-19672] tarfile extraction filter bypass allows creation of directories outside the destination
by Stan Ulbrych Aug. 19, 2026

Aug. 19, 2026

There is a MEDIUM severity vulnerability affecting CPython. The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-19672 * https://github.com/python/cpython/pull/156000

1 0

[CVE-2026-15806] urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme
by Kirill Podoprigora Aug. 18, 2026

Aug. 18, 2026

There is a MEDIUM severity vulnerability affecting CPython. The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs. Please see the linked CVE ID for the latest information on affected versions: - https://www.cve.org/CVERecord?id=CVE-2026-15806 - https://github.com/python/cpython/pull/155696

1 0

[CVE-2026-17084] StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0
by Seth Larson Aug. 18, 2026

Aug. 18, 2026

There is a MEDIUM severity vulnerability affecting CPython. The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-17084 * https://github.com/python/cpython/pull/155293

1 0

[CVE-2026-18503] Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
by Seth Larson Aug. 10, 2026

Aug. 10, 2026

There is a LOW severity vulnerability affecting CPython. Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff(). Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-18503 * https://github.com/python/cpython/pull/153694

1 0