# Python CPython vulnerabilities Source: https://junglewise.ai/threats/technologies/python-cpython Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 18:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/python-cpython.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 9 vulnerabilities in Python CPython: 4 in the last 7 days and 9 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-16052, was published on 12 November 2026. 3 vulnerabilities in the last four weeks, up 50% on the four before (2). ## Counts - Last 7 days: 4 - Last 30 days: 6 - Last 90 days: 9 - All time: 9 (0 critical, 0 exploited in the wild) ## About Python CPython Reference implementation of the Python programming language written in C. ## Latest Python CPython vulnerabilities - [CVE-2026-16052: Python http.cookies Morsel cookie attribute injection via unescaped semicolons](https://junglewise.ai/threats/cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in) (info, published 12 Nov 2026) - [CVE-2026-19552: CPython ssl.get_server_certificate hostname verification bypass](https://junglewise.ai/threats/cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server) (info, published 9 Nov 2026) - [CVE-2026-124249: Python http.cookiejar cookie deletion policy bypass](https://junglewise.ai/threats/cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response) (info, published 9 Nov 2026) - [CVE-2026-119170: Python hashlib FIPS algorithm enforcement regression](https://junglewise.ai/threats/cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for) (info, published 6 Nov 2026) - [CVE-2026-116566: Python socket.getaddrinfo() null byte truncation](https://junglewise.ai/threats/cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host) (info, published 29 Oct 2026) - [CVE-2026-103995: Python http.client HTTP response parsing bypass](https://junglewise.ai/threats/cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative) (info, published 27 Oct 2026) - [CVE-2026-19445: Python use-after-free in SSL server-side context with sni_callback](https://junglewise.ai/threats/cve-2026-19445-a-remote-unauthenticated-tls-client-can-make-a-server-crash-or) (info, published 30 Sep 2026) - [CVE-2026-12345: Python tempfile.TemporaryDirectory race condition in cleanup](https://junglewise.ai/threats/cve-2026-12345-the-cleanup-of-tempfile-temporarydirectory-is-vulnerable-to-a) (info, published 29 Sep 2026) - [CVE-2026-87910: Python tarfile filter bypass on link extraction fallback](https://junglewise.ai/threats/cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support) (info, published 11 Sep 2026) ## Most severe Python CPython vulnerabilities - [CVE-2026-87910: Python tarfile filter bypass on link extraction fallback](https://junglewise.ai/threats/cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support) (info, published 11 Sep 2026) - [CVE-2026-16052: Python http.cookies Morsel cookie attribute injection via unescaped semicolons](https://junglewise.ai/threats/cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in) (info, published 12 Nov 2026) - [CVE-2026-19552: CPython ssl.get_server_certificate hostname verification bypass](https://junglewise.ai/threats/cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server) (info, published 9 Nov 2026) - [CVE-2026-124249: Python http.cookiejar cookie deletion policy bypass](https://junglewise.ai/threats/cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response) (info, published 9 Nov 2026) - [CVE-2026-119170: Python hashlib FIPS algorithm enforcement regression](https://junglewise.ai/threats/cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for) (info, published 6 Nov 2026) - [CVE-2026-116566: Python socket.getaddrinfo() null byte truncation](https://junglewise.ai/threats/cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host) (info, published 29 Oct 2026) - [CVE-2026-103995: Python http.client HTTP response parsing bypass](https://junglewise.ai/threats/cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative) (info, published 27 Oct 2026) - [CVE-2026-19445: Python use-after-free in SSL server-side context with sni_callback](https://junglewise.ai/threats/cve-2026-19445-a-remote-unauthenticated-tls-client-can-make-a-server-crash-or) (info, published 30 Sep 2026) - [CVE-2026-12345: Python tempfile.TemporaryDirectory race condition in cleanup](https://junglewise.ai/threats/cve-2026-12345-the-cleanup-of-tempfile-temporarydirectory-is-vulnerable-to-a) (info, published 29 Sep 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up 50% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 2 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 3 | 0 | 0 | ## Other Python technologies - [Python](https://junglewise.ai/threats/technologies/python): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Python CPython vulnerabilities", https://junglewise.ai/threats/technologies/python-cpython, 12 November 2026.