Entrar Obtener clave API

2.0Baja

CVE-2026-103995Lenient parsing of integers for response body and chunk framing

Python Software Foundation CPython Publicada: 2026-10-27 22:58 (hace 6 días)

Descripción

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.

Debilidad (CWE): CWE-444

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
Python Software Foundation	CPython	< 3.16.0

Referencias y parches

Puntuación CVSS

2.0Baja

Fuente: PSF · CVSS 4.0

Vector de ataque: Red
Complejidad: Baja
Requisitos: Presentes
Privilegios: Altos
Interacción del usuario: Pasiva
Confidencialidad: Ninguno
Integridad: Ninguno
Disponibilidad: Ninguno

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Todas las puntuaciones (2)

cna	CVSS 4.0	2.0Baja
cna@python.org	CVSS 4.0	2.0Baja

EPSS (probabilidad de explotación en 30 días)

0.36%

superior al 30 % de todas las CVE

Cronología

ID reservado2026-10-01
Publicada2026-10-27 22:58
Llegó a IP-DB2026-10-27 23:03
Última actualización2026-10-28 18:24

Asignada por (CNA): PSF
Estado en NVD: Awaiting Analysis

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Python (CPython)

5.3Media

CVE-2026-116566 hace 4 días

socket.getaddrinfo() accepts embedded null bytes in host and port

Python Software Foundation CPython

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.

9.4Crítica

CVE-2026-115557 hace 9 días

Distrust compromised intermediate certificates in ssl module

Python Software Foundation CPython

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

6.9Media

CVE-2026-114583 hace 11 días

tar filter allows writing outside destination via empty-named symlink

Python Software Foundation CPython

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extracta…

7.6Alta

CVE-2026-19553 hace 1 mes

SSLContext.wrap_bio() missing validation of server_hostname parameter

Python Software Foundation CPython

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be si…

9.2Crítica

CVE-2026-19445 hace 1 mes

Use-after-free of a server-side SSLContext when sni_callback switches contexts

Python Software Foundation CPython

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …

5.9Media

CVE-2026-12345 hace 1 mes

Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

Python Software Foundation CPython

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permiss…