CVE-2026-8328
FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
CVE-2026-8328 is fixed in 103 products on 3 platforms, first by DEBIAN-CVE-2026-8328, released May 13, 2026. 10 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: Routine.
RoutineFixed on 3 platforms
CVSS
5.9
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0046
39th percentile
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Python 3.13 | 3.13.14 | Python 3.13 3.13.14 | Jun 10, 2026 |
| Python 3.14 | 3.14.6 | Python 3.14 3.14.6 | Jun 10, 2026 |
| Linux | |||
| idle-python3.10 · Ubuntu 22.04.1 LTS (jammy) | 3.10.12-1~22.04.16 | idle-python3.10 3.10.12-1~22.04.16 | Jul 7, 2026 |
| idle-python3.12 · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.15 | idle-python3.12 3.12.3-1ubuntu0.15 | Jul 7, 2026 |
| idle-python3.14 · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | idle-python3.14 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| libpython3.10 · Ubuntu 22.04.1 LTS (jammy) | 3.10.12-1~22.04.16 | libpython3.10 3.10.12-1~22.04.16 | Jul 7, 2026 |
| libpython3.10-minimal · Ubuntu 22.04.1 LTS (jammy) | 3.10.12-1~22.04.16 | libpython3.10-minimal 3.10.12-1~22.04.16 | Jul 7, 2026 |
| libpython3.10-stdlib · Ubuntu 22.04.1 LTS (jammy) | 3.10.12-1~22.04.16 | libpython3.10-stdlib 3.10.12-1~22.04.16 | Jul 7, 2026 |
| libpython3.10-testsuite · Ubuntu 22.04.1 LTS (jammy) | 3.10.12-1~22.04.16 | libpython3.10-testsuite 3.10.12-1~22.04.16 | Jul 7, 2026 |
| libpython3.12-minimal · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.15 | libpython3.12-minimal 3.12.3-1ubuntu0.15 | Jul 7, 2026 |
| libpython3.12-stdlib · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.15 | libpython3.12-stdlib 3.12.3-1ubuntu0.15 | Jul 7, 2026 |
| libpython3.12-testsuite · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.15 | libpython3.12-testsuite 3.12.3-1ubuntu0.15 | Jul 7, 2026 |
| libpython3.12t64 · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.15 | libpython3.12t64 3.12.3-1ubuntu0.15 | Jul 7, 2026 |
| libpython3.14 · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | libpython3.14 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| libpython3.14-minimal · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | libpython3.14-minimal 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| libpython3.14-stdlib · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | libpython3.14-stdlib 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| libpython3.14-testsuite · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | libpython3.14-testsuite 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| pypy3 · Debian 14 | 8.0.0+dfsg-1 | DEBIAN-CVE-2026-8328 | May 13, 2026 |
| python · sles 15.7 | 2.7.18-150000.123.1 | SUSE-SU-2026:3635-1 | Aug 18, 2026 |
| python-base · sles 15.7 | 2.7.18-150000.123.1 | SUSE-SU-2026:3635-1 | Aug 18, 2026 |
| python-unversioned-command · amzn 2023 | 3.9.25-1.amzn2023.0.7 | ALAS2023-2026-1933 | Jul 6, 2026 |
| python3 · amzn 2023 | 3.9.25-1.amzn2023.0.7 | ALAS2023-2026-1933 | Jul 6, 2026 |
| python3 · sles 15.6 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3 · sles 15.7 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3-core · sles 15.6 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3-core · sles 15.7 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3-debug · amzn 2023 | 3.9.25-1.amzn2023.0.7 | ALAS2023-2026-1933 | Jul 6, 2026 |
| python3-devel · amzn 2023 | 3.9.25-1.amzn2023.0.7 | ALAS2023-2026-1933 | Jul 6, 2026 |
| python3-idle · amzn 2023 | 3.9.25-1.amzn2023.0.7 | ALAS2023-2026-1933 | Jul 6, 2026 |
| python3-libs · amzn 2023 | 3.9.25-1.amzn2023.0.7 | ALAS2023-2026-1933 | Jul 6, 2026 |
| python3-test · amzn 2023 | 3.9.25-1.amzn2023.0.7 | ALAS2023-2026-1933 | Jul 6, 2026 |
| python3-tkinter · amzn 2023 | 3.9.25-1.amzn2023.0.7 | ALAS2023-2026-1933 | Jul 6, 2026 |
| python3.10 · Ubuntu 22.04.1 LTS (jammy) | 3.10.12-1~22.04.16 | python3.10 3.10.12-1~22.04.16 | Jul 7, 2026 |
| python3.10-examples · Ubuntu 22.04.1 LTS (jammy) | 3.10.12-1~22.04.16 | python3.10-examples 3.10.12-1~22.04.16 | Jul 7, 2026 |
| python3.10-full · Ubuntu 22.04.1 LTS (jammy) | 3.10.12-1~22.04.16 | python3.10-full 3.10.12-1~22.04.16 | Jul 7, 2026 |
| python3.10-minimal · Ubuntu 22.04.1 LTS (jammy) | 3.10.12-1~22.04.16 | python3.10-minimal 3.10.12-1~22.04.16 | Jul 7, 2026 |
| python3.10-nopie · Ubuntu 22.04.1 LTS (jammy) | 3.10.12-1~22.04.16 | python3.10-nopie 3.10.12-1~22.04.16 | Jul 7, 2026 |
| python3.10-venv · Ubuntu 22.04.1 LTS (jammy) | 3.10.12-1~22.04.16 | python3.10-venv 3.10.12-1~22.04.16 | Jul 7, 2026 |
| python3.11 · Debian 12.15 (bookworm) | 3.11.2-6+deb12u9 | DEBIAN-CVE-2026-8328 | May 13, 2026 |
| python3.11 · amzn 2023 | 3.11.15-1.amzn2023.0.3 | ALAS2023-2026-1930 | Jul 6, 2026 |
| python3.11-debug · amzn 2023 | 3.11.15-1.amzn2023.0.3 | ALAS2023-2026-1930 | Jul 6, 2026 |
| python3.11-debuginfo · amzn 2023 | 3.11.15-1.amzn2023.0.3 | ALAS2023-2026-1930 | Jul 6, 2026 |
| python3.11-debugsource · amzn 2023 | 3.11.15-1.amzn2023.0.3 | ALAS2023-2026-1930 | Jul 6, 2026 |
| python3.11-devel · amzn 2023 | 3.11.15-1.amzn2023.0.3 | ALAS2023-2026-1930 | Jul 6, 2026 |
| python3.11-idle · amzn 2023 | 3.11.15-1.amzn2023.0.3 | ALAS2023-2026-1930 | Jul 6, 2026 |
| python3.11-libs · amzn 2023 | 3.11.15-1.amzn2023.0.3 | ALAS2023-2026-1930 | Jul 6, 2026 |
| python3.11-test · amzn 2023 | 3.11.15-1.amzn2023.0.3 | ALAS2023-2026-1930 | Jul 6, 2026 |
| python3.11-tkinter · amzn 2023 | 3.11.15-1.amzn2023.0.3 | ALAS2023-2026-1930 | Jul 6, 2026 |
| python3.12 · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.15 | python3.12 3.12.3-1ubuntu0.15 | Jul 7, 2026 |
| python3.12 · amzn 2023 | 3.12.13-2.amzn2023.0.3 | ALAS2023-2026-1931 | Jul 6, 2026 |
| python3.12-debug · amzn 2023 | 3.12.13-2.amzn2023.0.3 | ALAS2023-2026-1931 | Jul 6, 2026 |
| python3.12-debuginfo · amzn 2023 | 3.12.13-2.amzn2023.0.3 | ALAS2023-2026-1931 | Jul 6, 2026 |
| python3.12-debugsource · amzn 2023 | 3.12.13-2.amzn2023.0.3 | ALAS2023-2026-1931 | Jul 6, 2026 |
| python3.12-devel · amzn 2023 | 3.12.13-2.amzn2023.0.3 | ALAS2023-2026-1931 | Jul 6, 2026 |
| python3.12-examples · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.15 | python3.12-examples 3.12.3-1ubuntu0.15 | Jul 7, 2026 |
| python3.12-full · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.15 | python3.12-full 3.12.3-1ubuntu0.15 | Jul 7, 2026 |
| python3.12-idle · amzn 2023 | 3.12.13-2.amzn2023.0.3 | ALAS2023-2026-1931 | Jul 6, 2026 |
| python3.12-libs · amzn 2023 | 3.12.13-2.amzn2023.0.3 | ALAS2023-2026-1931 | Jul 6, 2026 |
| python3.12-minimal · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.15 | python3.12-minimal 3.12.3-1ubuntu0.15 | Jul 7, 2026 |
| python3.12-nopie · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.15 | python3.12-nopie 3.12.3-1ubuntu0.15 | Jul 7, 2026 |
| python3.12-test · amzn 2023 | 3.12.13-2.amzn2023.0.3 | ALAS2023-2026-1931 | Jul 6, 2026 |
| python3.12-tkinter · amzn 2023 | 3.12.13-2.amzn2023.0.3 | ALAS2023-2026-1931 | Jul 6, 2026 |
| python3.12-venv · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.15 | python3.12-venv 3.12.3-1ubuntu0.15 | Jul 7, 2026 |
| python3.13 · Debian 13.5 (trixie) | 3.13.5-2+deb13u3 | DEBIAN-CVE-2026-8328 | May 13, 2026 |
| python3.13 · amzn 2023 | 3.13.14-1.amzn2023.0.1 | ALAS2023-2026-1910 | Jul 6, 2026 |
| python3.13-debug · amzn 2023 | 3.13.14-1.amzn2023.0.1 | ALAS2023-2026-1910 | Jul 6, 2026 |
| python3.13-debuginfo · amzn 2023 | 3.13.14-1.amzn2023.0.1 | ALAS2023-2026-1910 | Jul 6, 2026 |
| python3.13-debugsource · amzn 2023 | 3.13.14-1.amzn2023.0.1 | ALAS2023-2026-1910 | Jul 6, 2026 |
| python3.13-devel · amzn 2023 | 3.13.14-1.amzn2023.0.1 | ALAS2023-2026-1910 | Jul 6, 2026 |
| python3.13-freethreading · amzn 2023 | 3.13.14-1.amzn2023.0.1 | ALAS2023-2026-1910 | Jul 6, 2026 |
| python3.13-freethreading-debug · amzn 2023 | 3.13.14-1.amzn2023.0.1 | ALAS2023-2026-1910 | Jul 6, 2026 |
| python3.13-idle · amzn 2023 | 3.13.14-1.amzn2023.0.1 | ALAS2023-2026-1910 | Jul 6, 2026 |
| python3.13-libs · amzn 2023 | 3.13.14-1.amzn2023.0.1 | ALAS2023-2026-1910 | Jul 6, 2026 |
| python3.13-test · amzn 2023 | 3.13.14-1.amzn2023.0.1 | ALAS2023-2026-1910 | Jul 6, 2026 |
| python3.13-tkinter · amzn 2023 | 3.13.14-1.amzn2023.0.1 | ALAS2023-2026-1910 | Jul 6, 2026 |
| python3.14 · Debian 14 | 3.14.6-1 | DEBIAN-CVE-2026-8328 | May 13, 2026 |
| python3.14 · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | python3.14 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| python3.14 · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-debug · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-debuginfo · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-debugsource · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-devel · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-examples · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | python3.14-examples 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| python3.14-freethreading · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-freethreading-debug · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-freethreading-devel · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-freethreading-idle · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-freethreading-libs · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-freethreading-test · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-freethreading-tkinter · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-full · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | python3.14-full 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| python3.14-gdbm · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | python3.14-gdbm 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| python3.14-idle · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-libs · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-minimal · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | python3.14-minimal 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| python3.14-nopie · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | python3.14-nopie 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| python3.14-test · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-tk · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | python3.14-tk 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| python3.14-tkinter · amzn 2023 | 3.14.6-1.amzn2023.0.1 | ALAS2023-2026-1929 | Jul 6, 2026 |
| python3.14-venv · Ubuntu 26.04.1 LTS (resolute) | 3.14.4-1ubuntu0.1 | python3.14-venv 3.14.4-1ubuntu0.1 | Jun 8, 2026 |
| python3.9-debuginfo · amzn 2023 | 3.9.25-1.amzn2023.0.7 | ALAS2023-2026-1933 | Jul 6, 2026 |
| python3.9-debugsource · amzn 2023 | 3.9.25-1.amzn2023.0.7 | ALAS2023-2026-1933 | Jul 6, 2026 |
| python311 · sles 15.6 | 3.11.15-150600.3.62.2 | SUSE-SU-2026:3560-1 | Aug 10, 2026 |
| python311 · sles 15.7 | 3.11.15-150600.3.62.2 | SUSE-SU-2026:3560-1 | Aug 10, 2026 |
| python311-core · sles 15.6 | 3.11.15-150600.3.62.2 | SUSE-SU-2026:3560-1 | Aug 10, 2026 |
| python311-core · sles 15.7 | 3.11.15-150600.3.62.2 | SUSE-SU-2026:3560-1 | Aug 10, 2026 |
| python312 · sles 15.6 | 3.12.14-150600.3.68.1 | SUSE-SU-2026:4534-1 | Oct 6, 2026 |
| python312-core · sles 15.6 | 3.12.14-150600.3.68.1 | SUSE-SU-2026:4534-1 | Oct 6, 2026 |
| python313 · opensuse-leap 16.0 | 3.13.14-160000.2.1 | OPENSUSE-SU-2026:21595-1 | Aug 19, 2026 |
| python313 · sles 15.7 | 3.13.14-150700.4.53.1 | SUSE-SU-2026:3649-1 | Aug 19, 2026 |
| python313 · sles 16.0 | 3.13.14-160000.2.1 | SUSE-SU-2026:23303-1 | Aug 19, 2026 |
| python313-core · opensuse-leap 16.0 | 3.13.14-160000.2.1 | OPENSUSE-SU-2026:21595-1 | Aug 19, 2026 |
| python313-core · sles 15.7 | 3.13.14-150700.4.53.1 | SUSE-SU-2026:3649-1 | Aug 19, 2026 |
| python313-core · sles 16.0 | 3.13.14-160000.2.1 | SUSE-SU-2026:23303-1 | Aug 19, 2026 |
| python313-documentation · opensuse-leap 16.0 | 3.13.14-160000.2.1 | OPENSUSE-SU-2026:21595-1 | Aug 19, 2026 |
| python313-documentation · sles 16.0 | 3.13.14-160000.2.1 | SUSE-SU-2026:23303-1 | Aug 19, 2026 |
| python313-nogil · opensuse-leap 16.0 | 3.13.14-160000.2.1 | OPENSUSE-SU-2026:21595-1 | Aug 19, 2026 |
| python313-nogil-nogil-core · opensuse-leap 16.0 | 3.13.14-160000.2.1 | OPENSUSE-SU-2026:21595-1 | Aug 19, 2026 |
| No fix yet | |||
| Python 2 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.10 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.11 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.12 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.5 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.6 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.7 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.8 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.9 (Windows apps) | No fix yet | no-fix | n/a |
| Python3 (macOS) | No fix yet | no-fix | n/a |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.