USN-8509-1: Python vulnerabilities
It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-13462) It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534) It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-1299) It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-1502) It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297) It was discovered that Python's unicodedata.normalize() function had incorrect algorithmic complexity. An attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial of service. (CVE-2026-3276) It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644) It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of serv
CSIRTS triage
- What
- Multiple vulnerabilities could lead to path bypass, denial of service, or arbitrary header injection.
- Who is affected
- Users of Python on Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
- Urgency
- Remediation is critical due to the potential for various severe impacts.
- Action
- Update Python to the latest version.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Python
Get an email when a new Python advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://ubuntu.com/security/notices/USN-8509-1
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2025-134620.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
- Low exploitation riskCVE-2025-695340.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
- Low exploitation riskCVE-2026-12990.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
- Low exploitation riskCVE-2026-15020.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
- Low exploitation riskCVE-2026-22970.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all scored CVEs.
- Low exploitation riskCVE-2026-32760.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all scored CVEs.
- Low exploitation riskCVE-2026-36440.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all scored CVEs.
- Low exploitation riskCVE-2026-42240.62% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 46% of all scored CVEs.
- Low exploitation riskCVE-2026-45190.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
- Low exploitation riskCVE-2026-47860.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2025-13462 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-69534 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-1299 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-1502 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-2297 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-3276 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-3644 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-4224 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-4519 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-4786 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-5713 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-6019 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-6100 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-7774 | coverage & exploitation status | NVD · CVE.org |
| CVE-2021-4189 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-8328 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-9669 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[UPDATE] [medium] Python: Vulnerability allows code executioncert-bund
- low[UPDATE] [low] CPython: Vulnerability allows file manipulationcert-bund
- medium[UPDATE] [medium] CPython: Vulnerability allows bypassing security measurescert-bund
- medium[UPDATE] [medium] Cpython: Multiple vulnerabilitiescert-bund
- medium[UPDATE] [medium] CPython: Multiple vulnerabilitiescert-bund
- medium[UPDATE] [medium] CPython: Multiple vulnerabilitiescert-bund
- medium[UPDATE] [medium] Python: Multiple vulnerabilitiescert-bund
- medium[UPDATE] [medium] CPython: Multiple vulnerabilities allow file manipulation and DoScert-bund
- medium[UPDATE] [medium] CPython: Multiple vulnerabilitiescert-bund
- medium[UPDATE] [medium] CPython: Vulnerability allows Denial of Servicecert-bund
- medium[UPDATE] [medium] CPython: Vulnerability allows file manipulationcert-bund
- high[UPDATE] [high] Red Hat Enterprise Linux (JWCrypto and python-markdown): Multiple vulnerabilities allow denial…cert-bund
More from Ubuntu Security Notices
- unknownUSN-8530-1: Linux kernel (AWS) vulnerabilities2026-07-10
- unknownUSN-8529-1: Linux kernel vulnerabilities2026-07-10
- unknownUSN-8528-1: Linux kernel (Xilinx ZynqMP) vulnerabilities2026-07-10
- unknownUSN-8527-1: Linux kernel (Raspberry Pi) vulnerabilities2026-07-10
- unknownUSN-8492-5: Linux kernel (FIPS) vulnerabilities2026-07-10