pkg:Debian/pypy3

所有已知漏洞

• CRITICAL9.8CVE-2026-7210The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
  from 0
• CRITICAL9.8CVE-2022-48565An XML External Entity (XXE) issue was discovered in Python through 3.9.1.
  from 0, < 7.3.5+dfsg-2
• CRITICAL9.8CVE-2022-37454Buffer overflow in sponge queue functions
  from 0, < 7.3.5+dfsg-2+deb11u2
• CRITICAL9.8CVE-2022-37454Buffer overflow in sponge queue functions
  from 0, < 7.3.5+dfsg-2+deb11u2
• CRITICAL9.8CVE-2021-29921In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.
  from 0, < 7.3.8+dfsg-1
• CRITICAL9.8CVE-2020-27619In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
  from 0, < 7.3.5+dfsg-2
• CRITICAL9.4CVE-2025-4517Arbitrary writes via tarfile realpath overflow
  from 0
• HIGH7.8CVE-2024-9287Virtual environment (venv) activation scripts don't quote paths
  from 0, < 7.3.5+dfsg-2+deb11u4
• HIGH7.8CVE-2023-6597python3.7 - security update
  from 0, < 7.3.5+dfsg-2+deb11u3
• HIGH7.8CVE-2022-42919Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration.
  from 0
• HIGH7.6CVE-2015-20107python3.9 - security update
  from 0
• HIGH7.5CVE-2025-69534Python-Markdown has an Uncaught Exception
  from 0
• HIGH7.5CVE-2025-13836Excessive read buffering DoS in http.client
  from 0
• HIGH7.5CVE-2025-8194Tarfile infinite loop during parsing with negative member offset
  from 0
• HIGH7.5CVE-2025-4435Tarfile extracts filtered members when errorlevel=0
  from 0
• HIGH7.5CVE-2025-4330Extraction filter bypass for linking outside extraction directory
  from 0
• HIGH7.5CVE-2025-4138Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
  from 0
• HIGH7.5CVE-2024-6232Regular-expression DoS when parsing TarFile headers
  from 0, < 7.3.5+dfsg-2+deb11u5
• HIGH7.5CVE-2024-7592Quadratic complexity parsing cookies with backslashes
  from 0, < 7.3.5+dfsg-2+deb11u5
• HIGH7.5CVE-2024-4032Incorrect IPv4 and IPv6 private ranges
  from 0
• HIGH7.5CVE-2023-24329pypy3 - security update
  from 0, < 7.3.5+dfsg-2+deb11u3
• HIGH7.5CVE-2023-24329pypy3 - security update
  from 0, < 7.3.5+dfsg-2+deb11u3
• HIGH7.5CVE-2022-45061An issue was discovered in Python before 3.11.1.
  from 0, < 7.3.5+dfsg-2+deb11u4
• HIGH7.5CVE-2020-10735pypy3 - security update
  from 0, < 7.3.5+dfsg-2+deb11u4
• HIGH7.5CVE-2020-10735pypy3 - security update
  from 0, < 7.3.5+dfsg-2+deb11u4
• HIGH7.5CVE-2021-3737A flaw was found in python.
  from 0, < 7.3.5+dfsg-2+deb11u4
• HIGH7.5CVE-2022-0391python3.9 - security update
  from 0, < 7.3.5+dfsg-2+deb11u4
• HIGH7.5CVE-2020-29651py vulnerable to Regular Expression Denial of Service
  from 0, < 7.3.5+dfsg-2+deb11u4
• HIGH7.5CVE-2019-20907python3.5 - security update
  from 0, < 7.3.3+dfsg-1
• HIGH7.4CVE-2024-0397Memory race condition in ssl.SSLContext certificate store methods
  from 0
• HIGH7.4CVE-2021-28861Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginn…
  from 0, < 7.3.5+dfsg-2+deb11u4
• HIGH7.2CVE-2020-26116http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attac…
  from 0, < 7.3.3+dfsg-1
• MEDIUM6.5CVE-2024-5642Buffer overread when using an empty list with SSLContext.set_npn_protocols()
  from 0
• MEDIUM6.5CVE-2022-48564read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malform…
  from 0, < 7.3.5+dfsg-2
• MEDIUM6.5CVE-2021-3733python3.5 - security update
  from 0, < 7.3.5+dfsg-2
• MEDIUM6.2CVE-2024-0450Quoted zip-bomb protection for zipfile
  from 0, < 7.3.5+dfsg-2+deb11u3
• MEDIUM6.1CVE-2026-6019BaseCookie.js_output() does not neutralize embedded characters
  from 0
• MEDIUM5.9CVE-2022-48566An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1.
  from 0, < 7.3.5+dfsg-2
• MEDIUM5.9CVE-2021-23336Web Cache Poisoning
  from 0, < 7.3.3+dfsg-3
• MEDIUM5.7CVE-2021-3426There's a flaw in Python 3's pydoc.
  from 0, < 7.3.3+dfsg-4
• MEDIUM5.5CVE-2025-13837Out-of-memory when loading Plist
  from 0
• MEDIUM5.5CVE-2025-6075Quadratic complexity in os.path.expandvars() with user-controlled template
  from 0
• MEDIUM5.5CVE-2024-6923Email header injection due to unquoted newlines
  from 0, < 7.3.5+dfsg-2+deb11u5
• MEDIUM5.3CVE-2025-12781base64.b64decode() always accepts "+/" characters, despite setting altchars
  from 0
• MEDIUM5.3CVE-2025-12084Quadratic complexity in node ID cache clearing
  from 0
• MEDIUM5.3CVE-2024-12718Bypass extraction filter to modify file metadata outside extraction directory
  from 0
• MEDIUM5.3CVE-2023-40217An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5.
  from 0, < 7.3.5+dfsg-2+deb11u3
• MEDIUM5.3CVE-2023-27043The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character.
  from 0, < 7.3.5+dfsg-2+deb11u4
• MEDIUM5.3CVE-2021-4189A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode.
  from 0, < 7.3.5+dfsg-2
• MEDIUM4.3CVE-2025-8291ZIP64 End of Central Directory (EOCD) Locator record offset not checked
  from 0, < 7.3.5+dfsg-2+deb11u5
• MEDIUM4.3CVE-2025-6069HTMLParser quadratic complexity when processing malformed inputs
  from 0, < 7.3.5+dfsg-2+deb11u5
• LOW3.3CVE-2026-4519webbrowser.open() allows leading dashes in URLs
  from 0
• —CVE-2026-8328FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
  from 0
• —CVE-2026-4786Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
  from 0, < 7.3.22+dfsg-1
• —CVE-2026-3446Base64 decoding stops at first padded quad by default
  from 0
• —CVE-2026-1502HTTP client proxy tunnel headers not validated for CR/LF
  from 0
• —CVE-2026-3479pkgutil.get_data() does not enforce documented restrictions
  from 0
• —CVE-2026-2297SourcelessFileLoader does not use io.open_code()
  from 0
• —CVE-2026-1299email BytesGenerator header injection due to unquoted newlines
  from 0
• —CVE-2026-0865wsgiref.headers.Headers allows header newline injection
  from 0
• —CVE-2026-0672Header injection in http.cookies.Morsel
  from 0
• —CVE-2025-15367POP3 command injection in user-controlled commands
  from 0
• —CVE-2025-15366IMAP command injection in user-controlled commands
  from 0
• —CVE-2025-15282Header injection via newlines in data URL mediatype
  from 0
• —CVE-2025-11468Folding email comments of unfoldable characters doesn't preserve parenthesis
  from 0
• —CVE-2025-1795Mishandling of comma during folding and unicode-encoding of email headers
  from 0, < 7.3.5+dfsg-2+deb11u5
• —CVE-2025-0938URL parser allowed square brackets in domain names
  from 0, < 7.3.5+dfsg-2+deb11u5
• —CVE-2024-11168Improper validation of IPv6 and IPvFuture addresses
  from 0, < 7.3.5+dfsg-2+deb11u5
• —CVE-2024-11168Improper validation of IPv6 and IPvFuture addresses
  from 0, < 7.3.5+dfsg-2+deb11u5
• —CVE-2024-8088Infinite loop when iterating over zip archive entry names from zipfile.Path
  from 0