Vulnerability-Lookup

ubuntu-cve-2026-7774

Vulnerability from osv_ubuntu

Published

2026-06-04 16:16

Modified

2026-07-06 14:08

Summary

Details

tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.

Severity

6.9 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-7774	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-7774	REPORT
	https://www.openwall.com/lists/oss-security/2026/…	REPORT
	https://github.com/python/cpython/pull/149487	REPORT
	https://ubuntu.com/security/notices/USN-8509-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "pypy3",
            "binary_version": "7.3.1+dfsg-4ubuntu0.1"
          },
          {
            "binary_name": "pypy3-lib",
            "binary_version": "7.3.1+dfsg-4ubuntu0.1"
          },
          {
            "binary_name": "pypy3-lib-testsuite",
            "binary_version": "7.3.1+dfsg-4ubuntu0.1"
          },
          {
            "binary_name": "pypy3-tk",
            "binary_version": "7.3.1+dfsg-4ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "pypy3",
        "purl": "pkg:deb/ubuntu/pypy3@7.3.1+dfsg-4ubuntu0.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.1.1+dfsg-1",
        "7.2.0+dfsg-1",
        "7.3.0+dfsg-1",
        "7.3.0+dfsg-1ubuntu2",
        "7.3.0+dfsg-1ubuntu3",
        "7.3.1+dfsg-4",
        "7.3.1+dfsg-4ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "pypy3",
            "binary_version": "7.3.9+dfsg-1ubuntu0.1"
          },
          {
            "binary_name": "pypy3-lib",
            "binary_version": "7.3.9+dfsg-1ubuntu0.1"
          },
          {
            "binary_name": "pypy3-lib-testsuite",
            "binary_version": "7.3.9+dfsg-1ubuntu0.1"
          },
          {
            "binary_name": "pypy3-tk",
            "binary_version": "7.3.9+dfsg-1ubuntu0.1"
          },
          {
            "binary_name": "pypy3-venv",
            "binary_version": "7.3.9+dfsg-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "pypy3",
        "purl": "pkg:deb/ubuntu/pypy3@7.3.9+dfsg-1ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.3.5+dfsg-2",
        "7.3.7+dfsg-1",
        "7.3.7+dfsg-4",
        "7.3.7+dfsg-5",
        "7.3.8+dfsg-2",
        "7.3.9+dfsg-1",
        "7.3.9+dfsg-1ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "pypy3",
            "binary_version": "7.3.15+dfsg-1build3"
          },
          {
            "binary_name": "pypy3-lib",
            "binary_version": "7.3.15+dfsg-1build3"
          },
          {
            "binary_name": "pypy3-lib-testsuite",
            "binary_version": "7.3.15+dfsg-1build3"
          },
          {
            "binary_name": "pypy3-tk",
            "binary_version": "7.3.15+dfsg-1build3"
          },
          {
            "binary_name": "pypy3-venv",
            "binary_version": "7.3.15+dfsg-1build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "pypy3",
        "purl": "pkg:deb/ubuntu/pypy3@7.3.15+dfsg-1build3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.3.12+dfsg-1",
        "7.3.13+dfsg-1",
        "7.3.14+dfsg-1",
        "7.3.15+dfsg-1",
        "7.3.15+dfsg-1build2",
        "7.3.15+dfsg-1build3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "idle-python3.12",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "libpython3.12-minimal",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "libpython3.12-stdlib",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "libpython3.12-testsuite",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "libpython3.12t64",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12-examples",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12-full",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12-minimal",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12-nopie",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12-venv",
            "binary_version": "3.12.3-1ubuntu0.15"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "python3.12",
        "purl": "pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.15?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.3-1ubuntu0.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.12.0-1",
        "3.12.0-5",
        "3.12.0-6",
        "3.12.0-7",
        "3.12.1-2",
        "3.12.2-1",
        "3.12.2-4build3",
        "3.12.2-4build4",
        "3.12.2-5ubuntu3",
        "3.12.3-1",
        "3.12.3-1ubuntu0.1",
        "3.12.3-1ubuntu0.2",
        "3.12.3-1ubuntu0.3",
        "3.12.3-1ubuntu0.4",
        "3.12.3-1ubuntu0.5",
        "3.12.3-1ubuntu0.6",
        "3.12.3-1ubuntu0.7",
        "3.12.3-1ubuntu0.8",
        "3.12.3-1ubuntu0.9",
        "3.12.3-1ubuntu0.10",
        "3.12.3-1ubuntu0.11",
        "3.12.3-1ubuntu0.12",
        "3.12.3-1ubuntu0.13"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "pypy3",
            "binary_version": "7.3.20+dfsg-3"
          },
          {
            "binary_name": "pypy3-lib",
            "binary_version": "7.3.20+dfsg-3"
          },
          {
            "binary_name": "pypy3-lib-testsuite",
            "binary_version": "7.3.20+dfsg-3"
          },
          {
            "binary_name": "pypy3-tk",
            "binary_version": "7.3.20+dfsg-3"
          },
          {
            "binary_name": "pypy3-venv",
            "binary_version": "7.3.20+dfsg-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "pypy3",
        "purl": "pkg:deb/ubuntu/pypy3@7.3.20+dfsg-3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.3.19+dfsg-1",
        "7.3.19+dfsg-2",
        "7.3.20+dfsg-1",
        "7.3.20+dfsg-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "idle-python3.13",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "libpython3.13",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "libpython3.13-minimal",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "libpython3.13-stdlib",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "libpython3.13-testsuite",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "python3.13",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "python3.13-examples",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "python3.13-full",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "python3.13-gdbm",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "python3.13-minimal",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "python3.13-nopie",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "python3.13-tk",
            "binary_version": "3.13.7-1ubuntu0.4"
          },
          {
            "binary_name": "python3.13-venv",
            "binary_version": "3.13.7-1ubuntu0.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "python3.13",
        "purl": "pkg:deb/ubuntu/python3.13@3.13.7-1ubuntu0.4?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.13.3-1",
        "3.13.3-2",
        "3.13.3-4",
        "3.13.4-1",
        "3.13.5-1",
        "3.13.5-2",
        "3.13.6-1",
        "3.13.7-1",
        "3.13.7-1ubuntu0.1",
        "3.13.7-1ubuntu0.2",
        "3.13.7-1ubuntu0.3",
        "3.13.7-1ubuntu0.4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "idle-python3.14",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "libpython3.14",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "libpython3.14-minimal",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "libpython3.14-stdlib",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "libpython3.14-testsuite",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "python3.14",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "python3.14-examples",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "python3.14-full",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "python3.14-gdbm",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "python3.14-minimal",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "python3.14-nopie",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "python3.14-tk",
            "binary_version": "3.14.0-1ubuntu0.3"
          },
          {
            "binary_name": "python3.14-venv",
            "binary_version": "3.14.0-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "python3.14",
        "purl": "pkg:deb/ubuntu/python3.14@3.14.0-1ubuntu0.3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.14.0~a7-0ubuntu1",
        "3.14.0~b1-1",
        "3.14.0~b3-1",
        "3.14.0~rc1-1",
        "3.14.0~rc2-1",
        "3.14.0~rc3-1",
        "3.14.0-1",
        "3.14.0-1ubuntu0.1",
        "3.14.0-1ubuntu0.2",
        "3.14.0-1ubuntu0.3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "pypy3",
            "binary_version": "7.3.20+dfsg-4"
          },
          {
            "binary_name": "pypy3-lib",
            "binary_version": "7.3.20+dfsg-4"
          },
          {
            "binary_name": "pypy3-lib-testsuite",
            "binary_version": "7.3.20+dfsg-4"
          },
          {
            "binary_name": "pypy3-tk",
            "binary_version": "7.3.20+dfsg-4"
          },
          {
            "binary_name": "pypy3-venv",
            "binary_version": "7.3.20+dfsg-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "pypy3",
        "purl": "pkg:deb/ubuntu/pypy3@7.3.20+dfsg-4?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.3.20+dfsg-3",
        "7.3.20+dfsg-4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "idle-python3.14",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "libpython3.14",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "libpython3.14-minimal",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "libpython3.14-stdlib",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "libpython3.14-testsuite",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-examples",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-full",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-gdbm",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-minimal",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-nopie",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-tk",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-venv",
            "binary_version": "3.14.4-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "python3.14",
        "purl": "pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.4-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.14.0-1",
        "3.14.0-2",
        "3.14.0-4",
        "3.14.2-1",
        "3.14.3-1",
        "3.14.3-2",
        "3.14.3-3",
        "3.14.3-5",
        "3.14.4-1"
      ]
    }
  ],
  "aliases": [],
  "details": "tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.",
  "id": "UBUNTU-CVE-2026-7774",
  "modified": "2026-07-06T14:08:40Z",
  "published": "2026-06-04T16:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-7774"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7774"
    },
    {
      "type": "REPORT",
      "url": "https://www.openwall.com/lists/oss-security/2026/06/04/9"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/python/cpython/pull/149487"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8509-1"
    }
  ],
  "related": [
    "USN-8509-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-7774"
  ]
}

CVE-2026-7774 (GCVE-0-2026-7774)

Vulnerability from cvelistv5 – Published: 2026-06-04 14:21 – Updated: 2026-07-07 16:59

Title

tarfile.data_filter path traversal bypass allows writing outside the extraction directory

Summary

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22

Assigner

PSF

References

11 references

URL	Tags
https://github.com/python/cpython/pull/149487	patch
https://github.com/python/cpython/issues/149486	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/0478bd83…	patch
https://github.com/python/cpython/commit/0d28f5e4…	patch
https://github.com/python/cpython/commit/57841198…	patch
https://github.com/python/cpython/commit/5cf47a24…	patch
https://github.com/python/cpython/commit/74cca9a9…	patch
https://github.com/python/cpython/commit/10a13bee…	patch
https://github.com/python/cpython/commit/c063191c…	patch
http://www.openwall.com/lists/oss-security/2026/06/04/9

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.13.14 (python) Affected: 3.14.0 , < 3.14.6 (python) Affected: 3.15.0a1 , < 3.15.0b2 (python)

Credits

Phùng Siêu Đạt (OPSWAT Unit 515) Seth Larson (https://github.com/sethmlarson) Gregory P. Smith (https://github.com/gpshead) Petr Viktorin (https://github.com/encukou) Stan Ulbrych (https://github.com/StanFromIreland)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-7774",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T17:27:23.917872Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T17:27:34.304Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-04T18:45:41.657Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/04/9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "tarfile"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.13.14",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.6",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0b2",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ph\u00f9ng Si\u00eau \u0110\u1ea1t (OPSWAT Unit 515)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson (https://github.com/sethmlarson)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Gregory P. Smith (https://github.com/gpshead)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Petr Viktorin (https://github.com/encukou)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Stan Ulbrych (https://github.com/StanFromIreland)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process."
            }
          ],
          "value": "tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-07T16:59:55.298Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/149487"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/149486"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/4FU62L2M6RMMHT2QPGQNPEHHUND7CEX5/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/0478bd83d82b255e0f29f613367a59d261e7eaa2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/0d28f5e46e151718972dfabd91205444d0037b6d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/578411982c16f753f4893532510099ef665117da"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/5cf47a248c35c375d610b87b2f72fd1ed454b558"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/10a13bee3c24f9c62b602e696334ff2272a40efc"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c063191cb7f9170f9565e305f8aa2b79ab2bf609"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "tarfile.data_filter path traversal bypass allows writing outside the extraction directory",
      "x_generator": {
        "engine": "Vulnogram 0.6.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-7774",
    "datePublished": "2026-06-04T14:21:23.904Z",
    "dateReserved": "2026-05-04T14:47:51.154Z",
    "dateUpdated": "2026-07-07T16:59:55.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

usn-8509-1

Vulnerability from osv_ubuntu

Published

2026-07-06 11:48

Modified

2026-07-06 11:48

Summary

python3.10, python3.12, python3.14 vulnerabilities

Details

It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-13462)

It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)

It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-1299)

It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-1502)

It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)

It was discovered that Python's unicodedata.normalize() function had incorrect algorithmic complexity. An attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial of service. (CVE-2026-3276)

It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)

It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

It was discovered that Python's webbrowser module accepted leading dashes in URLs, which could be interpreted as command-line options. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)

It was discovered that Python incorrectly handled webbrowser.open() handlers. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2026-4786)

It was discovered that Python's remote debugging module did not properly validate offset tables when loading debug information. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)

It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method. An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019)

It was discovered that Python's lzma, bz2, and gzip decompressor objects had a use-after-free vulnerability. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. (CVE-2026-6100)

It was discovered that Python's tarfile module did not properly validate link targets when using the data filter. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)

It was discovered that the fix for CVE-2021-4189 in Python's ftplib module was incomplete, allowing PASV responses to be used in ftplib.ftpcp(). An attacker could possibly use this issue to perform server-side request forgery attacks. (CVE-2026-8328)

It was discovered that Python's bz2 module allowed reuse of a BZ2Decompressor object after a decompression error. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. (CVE-2026-9669)

References

URL

Type

	https://ubuntu.com/security/notices/USN-8509-1	ADVISORY
	https://ubuntu.com/security/CVE-2021-4189	REPORT
	https://ubuntu.com/security/CVE-2025-13462	REPORT
	https://ubuntu.com/security/CVE-2025-69534	REPORT
	https://ubuntu.com/security/CVE-2026-0672	REPORT
	https://ubuntu.com/security/CVE-2026-1299	REPORT
	https://ubuntu.com/security/CVE-2026-1502	REPORT
	https://ubuntu.com/security/CVE-2026-2297	REPORT
	https://ubuntu.com/security/CVE-2026-3276	REPORT
	https://ubuntu.com/security/CVE-2026-3644	REPORT
	https://ubuntu.com/security/CVE-2026-4224	REPORT
	https://ubuntu.com/security/CVE-2026-4519	REPORT
	https://ubuntu.com/security/CVE-2026-4786	REPORT
	https://ubuntu.com/security/CVE-2026-5713	REPORT
	https://ubuntu.com/security/CVE-2026-6019	REPORT
	https://ubuntu.com/security/CVE-2026-6100	REPORT
	https://ubuntu.com/security/CVE-2026-7774	REPORT
	https://ubuntu.com/security/CVE-2026-8328	REPORT
	https://ubuntu.com/security/CVE-2026-9669	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-13462",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-69534",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-1299",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-1502",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-2297",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-3276",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-3644",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-4224",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-4519",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-4786",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-6019",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-6100",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8328",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9669",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "idle-python3.10",
            "binary_version": "3.10.12-1~22.04.16"
          },
          {
            "binary_name": "libpython3.10",
            "binary_version": "3.10.12-1~22.04.16"
          },
          {
            "binary_name": "libpython3.10-minimal",
            "binary_version": "3.10.12-1~22.04.16"
          },
          {
            "binary_name": "libpython3.10-stdlib",
            "binary_version": "3.10.12-1~22.04.16"
          },
          {
            "binary_name": "libpython3.10-testsuite",
            "binary_version": "3.10.12-1~22.04.16"
          },
          {
            "binary_name": "python3.10",
            "binary_version": "3.10.12-1~22.04.16"
          },
          {
            "binary_name": "python3.10-examples",
            "binary_version": "3.10.12-1~22.04.16"
          },
          {
            "binary_name": "python3.10-full",
            "binary_version": "3.10.12-1~22.04.16"
          },
          {
            "binary_name": "python3.10-minimal",
            "binary_version": "3.10.12-1~22.04.16"
          },
          {
            "binary_name": "python3.10-nopie",
            "binary_version": "3.10.12-1~22.04.16"
          },
          {
            "binary_name": "python3.10-venv",
            "binary_version": "3.10.12-1~22.04.16"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "python3.10",
        "purl": "pkg:deb/ubuntu/python3.10@3.10.12-1~22.04.16?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.10.12-1~22.04.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.10.0-2",
        "3.10.0-3",
        "3.10.0-4",
        "3.10.0-5",
        "3.10.0-5build1",
        "3.10.1-1",
        "3.10.1-2",
        "3.10.2-1",
        "3.10.2-5",
        "3.10.2-7",
        "3.10.3-1",
        "3.10.4-3",
        "3.10.4-3ubuntu0.1",
        "3.10.6-1~22.04",
        "3.10.6-1~22.04.1",
        "3.10.6-1~22.04.2",
        "3.10.6-1~22.04.2ubuntu1",
        "3.10.6-1~22.04.2ubuntu1.1",
        "3.10.12-1~22.04.2",
        "3.10.12-1~22.04.3",
        "3.10.12-1~22.04.4",
        "3.10.12-1~22.04.5",
        "3.10.12-1~22.04.6",
        "3.10.12-1~22.04.7",
        "3.10.12-1~22.04.8",
        "3.10.12-1~22.04.9",
        "3.10.12-1~22.04.10",
        "3.10.12-1~22.04.11",
        "3.10.12-1~22.04.12",
        "3.10.12-1~22.04.13",
        "3.10.12-1~22.04.14",
        "3.10.12-1~22.04.15"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-13462",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-69534",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-1299",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-1502",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-2297",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-3276",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-3644",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-4224",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-4519",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-4786",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-6019",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-6100",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-7774",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8328",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9669",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "idle-python3.12",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "libpython3.12-minimal",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "libpython3.12-stdlib",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "libpython3.12-testsuite",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "libpython3.12t64",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12-examples",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12-full",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12-minimal",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12-nopie",
            "binary_version": "3.12.3-1ubuntu0.15"
          },
          {
            "binary_name": "python3.12-venv",
            "binary_version": "3.12.3-1ubuntu0.15"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "python3.12",
        "purl": "pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.15?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.3-1ubuntu0.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.12.0-1",
        "3.12.0-5",
        "3.12.0-6",
        "3.12.0-7",
        "3.12.1-2",
        "3.12.2-1",
        "3.12.2-4build3",
        "3.12.2-4build4",
        "3.12.2-5ubuntu3",
        "3.12.3-1",
        "3.12.3-1ubuntu0.1",
        "3.12.3-1ubuntu0.2",
        "3.12.3-1ubuntu0.3",
        "3.12.3-1ubuntu0.4",
        "3.12.3-1ubuntu0.5",
        "3.12.3-1ubuntu0.6",
        "3.12.3-1ubuntu0.7",
        "3.12.3-1ubuntu0.8",
        "3.12.3-1ubuntu0.9",
        "3.12.3-1ubuntu0.10",
        "3.12.3-1ubuntu0.11",
        "3.12.3-1ubuntu0.12",
        "3.12.3-1ubuntu0.13"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-1502",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-3276",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-4786",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-5713",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-6019",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-6100",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-7774",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8328",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9669",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:26.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "idle-python3.14",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "libpython3.14",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "libpython3.14-minimal",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "libpython3.14-stdlib",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "libpython3.14-testsuite",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-examples",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-full",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-gdbm",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-minimal",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-nopie",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-tk",
            "binary_version": "3.14.4-1ubuntu0.1"
          },
          {
            "binary_name": "python3.14-venv",
            "binary_version": "3.14.4-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "python3.14",
        "purl": "pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.4-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.14.0-1",
        "3.14.0-2",
        "3.14.0-4",
        "3.14.2-1",
        "3.14.3-1",
        "3.14.3-2",
        "3.14.3-3",
        "3.14.3-5",
        "3.14.4-1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Python incorrectly normalized paths in the tarfile\nmodule. An attacker could possibly use this issue to bypass path\nrestrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04\nLTS. (CVE-2025-13462)\n\nIt was discovered that Python\u0027s HTMLParser incorrectly handled certain\nmalformed HTML input. An attacker could possibly use this issue to cause\nPython to crash, resulting in a denial of service. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)\n\nIt was discovered that Python\u0027s email module incorrectly quoted newlines\nin headers. An attacker could possibly use this issue to inject arbitrary\nemail headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2026-1299)\n\nIt was discovered that Python\u0027s http.client module did not properly\nsanitize carriage return and linefeed characters when handling HTTP\nCONNECT tunnel request headers. An attacker could possibly use this issue\nto inject arbitrary HTTP headers. (CVE-2026-1502)\n\nIt was discovered that Python\u0027s importlib module did not generate an\naudit event when loading legacy .pyc files. An attacker could possibly\nuse this issue to bypass auditing mechanisms. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)\n\nIt was discovered that Python\u0027s unicodedata.normalize() function had\nincorrect algorithmic complexity. An attacker could possibly use this\nissue to cause Python to consume excessive resources, leading to a denial\nof service. (CVE-2026-3276)\n\nIt was discovered that Python\u0027s http.cookies module incorrectly handled\ncontrol characters in certain cookie operations. An attacker could possibly\nuse this issue to inject arbitrary content. This issue only affected Ubuntu\n22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)\n\nIt was discovered that the Python pyexpat module was vulnerable to\nunbounded recursion in the Expat XML parser. An attacker could possibly use\nthis issue to cause Python to crash, resulting in a denial of service. This\nissue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)\n\nIt was discovered that Python\u0027s webbrowser module accepted leading dashes\nin URLs, which could be interpreted as command-line options. An attacker\ncould possibly use this issue to execute arbitrary commands. This issue\nonly affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)\n\nIt was discovered that Python incorrectly handled webbrowser.open()\nhandlers. An attacker could possibly use this issue to execute arbitrary\ncommands. (CVE-2026-4786)\n\nIt was discovered that Python\u0027s remote debugging module did not properly\nvalidate offset tables when loading debug information. An attacker could\npossibly use this issue to cause Python to crash or execute arbitrary\ncode. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)\n\nIt was discovered that Python\u0027s http.cookies module incorrectly escaped\nvalues in the js_output() method. An attacker could possibly use this issue\nto inject arbitrary JavaScript. (CVE-2026-6019)\n\nIt was discovered that Python\u0027s lzma, bz2, and gzip decompressor objects\nhad a use-after-free vulnerability. An attacker could possibly use this\nissue to cause Python to crash or execute arbitrary code. (CVE-2026-6100)\n\nIt was discovered that Python\u0027s tarfile module did not properly validate\nlink targets when using the data filter. An attacker could possibly use\nthis issue to bypass path restrictions. This issue only affected Ubuntu\n24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)\n\nIt was discovered that the fix for CVE-2021-4189 in Python\u0027s ftplib module\nwas incomplete, allowing PASV responses to be used in ftplib.ftpcp(). An\nattacker could possibly use this issue to perform server-side request\nforgery attacks. (CVE-2026-8328)\n\nIt was discovered that Python\u0027s bz2 module allowed reuse of a\nBZ2Decompressor object after a decompression error. An attacker could\npossibly use this issue to cause Python to crash or execute arbitrary\ncode. (CVE-2026-9669)",
  "id": "USN-8509-1",
  "modified": "2026-07-06T11:48:55Z",
  "published": "2026-07-06T11:48:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8509-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-4189"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-13462"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-69534"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-0672"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-1299"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-1502"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-2297"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-3276"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-3644"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-4224"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-4519"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-4786"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-5713"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-6019"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-6100"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-7774"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-8328"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-9669"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "python3.10, python3.12, python3.14 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2021-4189",
    "UBUNTU-CVE-2025-13462",
    "UBUNTU-CVE-2025-69534",
    "UBUNTU-CVE-2026-0672",
    "UBUNTU-CVE-2026-1299",
    "UBUNTU-CVE-2026-1502",
    "UBUNTU-CVE-2026-2297",
    "UBUNTU-CVE-2026-3276",
    "UBUNTU-CVE-2026-3644",
    "UBUNTU-CVE-2026-4224",
    "UBUNTU-CVE-2026-4519",
    "UBUNTU-CVE-2026-4786",
    "UBUNTU-CVE-2026-5713",
    "UBUNTU-CVE-2026-6019",
    "UBUNTU-CVE-2026-6100",
    "UBUNTU-CVE-2026-7774",
    "UBUNTU-CVE-2026-8328",
    "UBUNTU-CVE-2026-9669"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2026-7774

Vulnerability from osv_ubuntu

CVE-2026-7774 (GCVE-0-2026-7774)

usn-8509-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature