{"schema_version":1,"title":"Python CPython vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in Python CPython: 4 in the last 7 days and 9 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-16052, was published on 12 November 2026. 3 vulnerabilities in the last four weeks, up 50% on the four before (2).","url":"https://junglewise.ai/threats/technologies/python-cpython","json_url":"https://junglewise.ai/threats/technologies/python-cpython.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/python-cpython","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":9,"critical":0,"exploited":0,"last_7_days":4,"last_30_days":6,"last_90_days":9,"last_365_days":9},"latest":[{"cve":"CVE-2026-16052","slug":"cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in","title":"Python http.cookies Morsel cookie attribute injection via unescaped semicolons","severity":"info","exploited":false,"published_at":"2026-11-12T17:17:44.237+00:00","url":"https://junglewise.ai/threats/cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in"},{"cve":"CVE-2026-19552","slug":"cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server","title":"CPython ssl.get_server_certificate hostname verification bypass","severity":"info","exploited":false,"published_at":"2026-11-09T15:17:21.017+00:00","url":"https://junglewise.ai/threats/cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server"},{"cve":"CVE-2026-124249","slug":"cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response","title":"Python http.cookiejar cookie deletion policy bypass","severity":"info","exploited":false,"published_at":"2026-11-09T15:17:14.963+00:00","url":"https://junglewise.ai/threats/cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response"},{"cve":"CVE-2026-119170","slug":"cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for","title":"Python hashlib FIPS algorithm enforcement regression","severity":"info","exploited":false,"published_at":"2026-11-06T15:17:12.073+00:00","url":"https://junglewise.ai/threats/cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for"},{"cve":"CVE-2026-116566","slug":"cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host","title":"Python socket.getaddrinfo() null byte truncation","severity":"info","exploited":false,"published_at":"2026-10-29T18:17:24.667+00:00","url":"https://junglewise.ai/threats/cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host"},{"cve":"CVE-2026-103995","slug":"cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative","title":"Python http.client HTTP response parsing bypass","severity":"info","exploited":false,"published_at":"2026-10-27T20:17:11.137+00:00","url":"https://junglewise.ai/threats/cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative"},{"cve":"CVE-2026-19445","slug":"cve-2026-19445-a-remote-unauthenticated-tls-client-can-make-a-server-crash-or","title":"Python use-after-free in SSL server-side context with sni_callback","severity":"info","exploited":false,"published_at":"2026-09-30T17:16:45.72+00:00","url":"https://junglewise.ai/threats/cve-2026-19445-a-remote-unauthenticated-tls-client-can-make-a-server-crash-or"},{"cve":"CVE-2026-12345","slug":"cve-2026-12345-the-cleanup-of-tempfile-temporarydirectory-is-vulnerable-to-a","title":"Python tempfile.TemporaryDirectory race condition in cleanup","severity":"info","exploited":false,"published_at":"2026-09-29T18:17:14.707+00:00","url":"https://junglewise.ai/threats/cve-2026-12345-the-cleanup-of-tempfile-temporarydirectory-is-vulnerable-to-a"},{"cve":"CVE-2026-87910","epss":0.0054,"slug":"cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support","title":"Python tarfile filter bypass on link extraction fallback","severity":"info","exploited":false,"published_at":"2026-09-11T18:16:59.8+00:00","url":"https://junglewise.ai/threats/cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":3}],"related":[{"name":"Python","slug":"python","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/python"}],"technology":{"hub":true,"name":"Python CPython","slug":"python-cpython","vendor":{"hub":true,"name":"Python","slug":"python","url":"https://junglewise.ai/threats/vendors/python"},"aliases":[],"category":"library","description":"Reference implementation of the Python programming language written in C.","url":"https://junglewise.ai/threats/technologies/python-cpython"},"most_severe":[{"cve":"CVE-2026-87910","epss":0.0054,"slug":"cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support","title":"Python tarfile filter bypass on link extraction fallback","severity":"info","exploited":false,"published_at":"2026-09-11T18:16:59.8+00:00","url":"https://junglewise.ai/threats/cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support"},{"cve":"CVE-2026-16052","slug":"cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in","title":"Python http.cookies Morsel cookie attribute injection via unescaped semicolons","severity":"info","exploited":false,"published_at":"2026-11-12T17:17:44.237+00:00","url":"https://junglewise.ai/threats/cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in"},{"cve":"CVE-2026-19552","slug":"cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server","title":"CPython ssl.get_server_certificate hostname verification bypass","severity":"info","exploited":false,"published_at":"2026-11-09T15:17:21.017+00:00","url":"https://junglewise.ai/threats/cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server"},{"cve":"CVE-2026-124249","slug":"cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response","title":"Python http.cookiejar cookie deletion policy bypass","severity":"info","exploited":false,"published_at":"2026-11-09T15:17:14.963+00:00","url":"https://junglewise.ai/threats/cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response"},{"cve":"CVE-2026-119170","slug":"cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for","title":"Python hashlib FIPS algorithm enforcement regression","severity":"info","exploited":false,"published_at":"2026-11-06T15:17:12.073+00:00","url":"https://junglewise.ai/threats/cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for"},{"cve":"CVE-2026-116566","slug":"cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host","title":"Python socket.getaddrinfo() null byte truncation","severity":"info","exploited":false,"published_at":"2026-10-29T18:17:24.667+00:00","url":"https://junglewise.ai/threats/cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host"},{"cve":"CVE-2026-103995","slug":"cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative","title":"Python http.client HTTP response parsing bypass","severity":"info","exploited":false,"published_at":"2026-10-27T20:17:11.137+00:00","url":"https://junglewise.ai/threats/cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative"},{"cve":"CVE-2026-19445","slug":"cve-2026-19445-a-remote-unauthenticated-tls-client-can-make-a-server-crash-or","title":"Python use-after-free in SSL server-side context with sni_callback","severity":"info","exploited":false,"published_at":"2026-09-30T17:16:45.72+00:00","url":"https://junglewise.ai/threats/cve-2026-19445-a-remote-unauthenticated-tls-client-can-make-a-server-crash-or"},{"cve":"CVE-2026-12345","slug":"cve-2026-12345-the-cleanup-of-tempfile-temporarydirectory-is-vulnerable-to-a","title":"Python tempfile.TemporaryDirectory race condition in cleanup","severity":"info","exploited":false,"published_at":"2026-09-29T18:17:14.707+00:00","url":"https://junglewise.ai/threats/cve-2026-12345-the-cleanup-of-tempfile-temporarydirectory-is-vulnerable-to-a"}],"generated_at":"2026-11-12T18:07:00.176012+00:00"}