Search results

[3.13] gh-111264: Add a note about untrusted input to tomllib docs (GH-146209) (GH-149223)

awaiting review

docsDocumentation in the Doc dirDocumentation in the Doc dir

skip news

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 149226

#149226 In python/cpython;

· miss-islington opened on May 1, 2026

[3.13] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (GH-149073)

awaiting review

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 149099

#149099 In python/cpython;

· miss-islington opened on Apr 28, 2026

[3.12] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591)

awaiting review

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 149066

#149066 In python/cpython;

· miss-islington opened on Apr 27, 2026

[3.12] gh-148808: Add boundary check to asyncio.AbstractEventLoop.sock_recvf… (GH-148809)

awaiting merge

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 148835

#148835 In python/cpython;

· miss-islington opened on Apr 21, 2026

[3.11] gh-148808: Add boundary check to asyncio.AbstractEventLoop.sock_recvf… (GH-148809)

awaiting review

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 148834

#148834 In python/cpython;

· miss-islington opened on Apr 21, 2026

[3.13] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)

awaiting review

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 148343

#148343 In python/cpython;

· miss-islington opened on Apr 10, 2026

[3.12] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)

awaiting review

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 148341

#148341 In python/cpython;

· miss-islington opened on Apr 10, 2026

[3.11] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600)

awaiting merge

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 146026

#146026 In python/cpython;

· miss-islington opened on Mar 16, 2026

[3.12] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600)

awaiting merge

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 146025

#146025 In python/cpython;

· miss-islington opened on Mar 16, 2026

[3.12] gh-141707: Skip TarInfo DIRTYPE normalization during GNU long name handling

awaiting merge

release-blocker

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 145817

#145817 In python/cpython;

· miss-islington opened on Mar 11, 2026

[3.12] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (GH-144371)

awaiting merge

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 145671

#145671 In python/cpython;

· miss-islington opened on Mar 9, 2026

[3.12] gh-145506: Fixes CVE-2026-2297 by ensuring SourcelessFileLoader uses io.open_code (GH-145507)

awaiting merge

type-securityA security issueA security issue

Status: Open (in progress).

python/cpythonnumber 145514

#145514 In python/cpython;

· miss-islington opened on Mar 4, 2026