Search

Issues

• [3.15] gh-160369: Reject buffered plaintext after IMAP STARTTLS (GH-160370)

  Unread
  #161761· opened Nov 10, 2026 · Updated Nov 10, 2026

• [3.14] gh-160369: Reject buffered plaintext after IMAP STARTTLS (GH-160370)

  Unread
  #161760· opened Nov 10, 2026 · Updated Nov 10, 2026

• [3.13] gh-160369: Discard cached responses after IMAP STARTTLS (GH-160370)

  Unread
  #161759· opened Nov 10, 2026 · Updated Nov 10, 2026

• [3.12] gh-160369: Discard cached responses after IMAP STARTTLS (GH-160370)

  Unread
  #161758· opened Nov 10, 2026 · Updated Nov 10, 2026

• [3.11] gh-160369: Discard cached responses after IMAP STARTTLS (GH-160370)

  Unread
  #161757· opened Nov 10, 2026 · Updated Nov 10, 2026

• [3.12] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI

  Unread
  #161727· opened Nov 10, 2026 · Updated Nov 11, 2026
  1

• [3.13] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (#161706) (#161719)

  Unread
  #161726· opened Nov 10, 2026 · Updated Nov 11, 2026
  4

• Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel.OutputString()

  python/cpython#161707 · opened on Nov 9, 2026
  1

• [security] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI [CVE-2026-115791]

  python/cpython#161705 · opened on Nov 9, 2026

• [3.11] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570)

  Unread
  #161583· opened Nov 7, 2026 · Updated Nov 9, 2026
  1

• [3.12] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570)

  Unread
  #161582· opened Nov 7, 2026 · Updated Nov 9, 2026
  1

• [3.13] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570)

  Unread
  #161581· opened Nov 7, 2026 · Updated Nov 9, 2026
  1

• http.cookiejar deletes cookies of other domains via expired Set-Cookie [CVE-2026-124249]

  python/cpython#161569 · opened on Nov 7, 2026

• ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity

  python/cpython#161503 · opened on Nov 6, 2026

• tarfile: Windows same-drive drive-relative symlink not caught by data filter

  python/cpython#161323 · opened on Nov 4, 2026

• [3.11] gh-161192: Update bundled Expat to 2.10.0 (GH-161202)

  Unread
  #161266· opened Nov 3, 2026 · Updated Nov 11, 2026

• [3.12] gh-161192: Update bundled Expat to 2.10.0 (GH-161202)

  Unread
  #161218· opened Nov 2, 2026 · Updated Nov 11, 2026

• [3.13] gh-161192: Update bundled Expat to 2.10.0 (GH-161202)

  Unread
  #161217· opened Nov 2, 2026 · Updated Nov 11, 2026

• Upgrade bundled Expat to 2.10.0 (e.g. for fixes to four vulnerabilities)

  python/cpython#161192 · opened on Nov 2, 2026

• [3.11] gh-160506: Fix ntpath.realpath() for broken links via directory links (GH-160507)

  Unread
  #161030· opened Oct 31, 2026 · Updated Nov 9, 2026

• [3.12] gh-160506: Fix ntpath.realpath() for broken links via directory links (GH-160507)

  Unread
  #161029· opened Oct 31, 2026 · Updated Nov 9, 2026

• [3.13] gh-160506: Fix ntpath.realpath() for broken links via directory links (GH-160507)

  Unread
  #161028· opened Oct 31, 2026 · Updated Nov 9, 2026

• [3.11] gh-160898: Reject null bytes in socket.getaddrinfo() host and port (GH-160899)

  Unread
  #160977· opened Oct 30, 2026 · Updated Nov 12, 2026
  2

• [3.12] gh-160898: Reject null bytes in socket.getaddrinfo() host and port (GH-160899)

  Unread
  #160975· opened Oct 30, 2026 · Updated Oct 30, 2026
  1

• [3.13] gh-160898: Reject null bytes in socket.getaddrinfo() host and port (GH-160899)

  Unread
  #160974· opened Oct 30, 2026 · Updated Oct 30, 2026
  1