pkg:Debian/python3.14

All known vulnerabilities

• CRITICAL9.8CVE-2026-7210The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
  from 0
• CRITICAL9.8CVE-2025-13462tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling
  from 0, < 3.14.3-4
• HIGH7.5Stack overflow parsing XML with deeply nested DTD content models
  from 0, < 3.14.3-4
• HIGH7.5Incomplete control character validation in http.cookies
  from 0, < 3.14.3-4
• HIGH7.5Excessive read buffering DoS in http.client
  from 0, < 3.14.2-1
• MEDIUM6.1BaseCookie.js_output() does not neutralize embedded characters
  from 0, < 3.14.5~rc1-1
• MEDIUM5.5Out-of-memory when loading Plist
  from 0, < 3.14.2-1
• MEDIUM5.5Quadratic complexity in os.path.expandvars() with user-controlled template
  from 0, < 3.14.2-1
• MEDIUM5.3base64.b64decode() always accepts "+/" characters, despite setting altchars
  from 0
• MEDIUM5.3Quadratic complexity in node ID cache clearing
  from 0, < 3.14.2-1
• MEDIUM4.3ZIP64 End of Central Directory (EOCD) Locator record offset not checked
  from 0, < 3.14.0-3
• LOW3.3webbrowser.open() allows leading dashes in URLs
  from 0, < 3.14.4-1
• —bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
  from 0
• —tarfile.data_filter path traversal bypass allows writing outside the extraction directory
  from 0
• —Potential DoS via quadratic complexity in unicodedata.normalize()
  from 0
• —FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
  from 0
• —Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target
  from 0, < 3.14.5-1
• —Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
  from 0, < 3.14.5-1
• —Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
  from 0, < 3.14.5~rc1-1
• —Base64 decoding stops at first padded quad by default
  from 0, < 3.14.4-1
• —HTTP client proxy tunnel headers not validated for CR/LF
  from 0, < 3.14.5-1
• —pkgutil.get_data() does not enforce documented restrictions
  from 0
• —SourcelessFileLoader does not use io.open_code()
  from 0, < 3.14.3-4
• —email BytesGenerator header injection due to unquoted newlines
  from 0, < 3.14.3-1
• —wsgiref.headers.Headers allows header newline injection
  from 0, < 3.14.3-1
• —Header injection in http.cookies.Morsel
  from 0, < 3.14.3-1
• —POP3 command injection in user-controlled commands
  from 0
• —IMAP command injection in user-controlled commands
  from 0
• —Header injection via newlines in data URL mediatype
  from 0, < 3.14.3-1
• —python3.9 - security update
  from 0, < 3.14.3-1