| Bug | bullseye | bookworm | trixie | forky | sid | Description |
|---|
| CVE-2026-0865 | vulnerable | vulnerable | vulnerable | vulnerable | vulnerable | User-controlled header names and values containing newlines can allow ... |
| CVE-2025-15367 | vulnerable | vulnerable | vulnerable | vulnerable | vulnerable | The poplib module, when passed a user-controlled command, can have add ... |
| CVE-2025-15366 | vulnerable | vulnerable | vulnerable | vulnerable | vulnerable | The imaplib module, when passed a user-controlled command, can have ad ... |
| CVE-2025-15282 | vulnerable | vulnerable | vulnerable | vulnerable | vulnerable | User-controlled data URLs parsed by urllib.request.DataHandler allow i ... |
| CVE-2025-12084 | vulnerable | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | vulnerable | When building nested elements using xml.dom.minidom methods such as ap ... |
| CVE-2025-8291 | vulnerable | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | vulnerable | The 'zipfile' module would not check the validity of the ZIP64 End of ... |
| CVE-2025-6069 | vulnerable | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | vulnerable | The html.parser.HTMLParser class had worse-case quadratic complexity w ... |
| CVE-2019-16935 | vulnerable (no DSA, ignored) | fixed | fixed | fixed | fixed | The documentation XML-RPC server in Python through 2.7.16, 3.x through ... |
| Bug | Description |
|---|
| CVE-2025-11468 | When folding a long comment in an email header containing exclusively ... |
| CVE-2025-4517 | Allows arbitrary filesystem writes outside the extraction directory du ... |
| CVE-2025-4435 | When using a TarFile.errorlevel = 0and extracting with a filter the do ... |
| CVE-2025-4330 | Allows the extraction filter to be ignored, allowing symlink targets t ... |
| CVE-2025-4138 | Allows the extraction filter to be ignored, allowing symlink targets t ... |
| CVE-2024-12718 | Allows modifying some file metadata (e.g. last modified) with filter=" ... |
| CVE-2016-4000 | Jython before 2.7.1rc1 allows attackers to execute arbitrary code via ... |
| CVE-2013-2027 | Jython 2.2.1 uses the current umask to set the privileges of the class ... |