{
  "product": "Python 3.12",
  "url": "https://patchblox.com/security/product/windows-app/python-3.12",
  "summary": "The latest version of Python 3.12 is 3.12.10, released April 8, 2025. Patch Radar has 8 security fixes for Python 3.12, closing 17 CVEs. The newest security fix is Python 3.12 3.12.9, released February 4, 2025. Version 3.12.10 adds no new CVE fixes and includes all of them. 57 CVEs have no fix yet.",
  "platform": "windows-app",
  "vendor": "Python Software Foundation",
  "supported": true,
  "latestVersion": "3.12.10",
  "latestReleased": "2025-04-08T00:00:00Z",
  "latestIncludesAllFixes": true,
  "fixCount": 8,
  "cveCount": 17,
  "exploitedCveCount": 0,
  "unfixedCveCount": 57,
  "fixes": [
    {
      "fix": "Python 3.12 3.12.9",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.12-3.12.9",
      "released": "2025-02-04T00:00:00Z",
      "fixedVersion": "3.12.9",
      "priority": "High",
      "cveCount": 2,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.12 3.12.8",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.12-3.12.8",
      "released": "2024-12-03T00:00:00Z",
      "fixedVersion": "3.12.8",
      "priority": "High",
      "cveCount": 1,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.12 3.12.6",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.12-3.12.6",
      "released": "2024-09-06T00:00:00Z",
      "fixedVersion": "3.12.6",
      "priority": "High",
      "cveCount": 4,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.12 3.12.5",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.12-3.12.5",
      "released": "2024-08-06T00:00:00Z",
      "fixedVersion": "3.12.5",
      "priority": "High",
      "cveCount": 2,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.12 3.12.4",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.12-3.12.4",
      "released": "2024-06-06T00:00:00Z",
      "fixedVersion": "3.12.4",
      "priority": "High",
      "cveCount": 2,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.12 3.12.3",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.12-3.12.3",
      "released": "2024-04-09T00:00:00Z",
      "fixedVersion": "3.12.3",
      "priority": "High",
      "cveCount": 2,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.12 3.12.2",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.12-3.12.2",
      "released": "2024-02-06T00:00:00Z",
      "fixedVersion": "3.12.2",
      "priority": "Routine",
      "cveCount": 1,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.12 3.12.1",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.12-3.12.1",
      "released": "2023-12-07T00:00:00Z",
      "fixedVersion": "3.12.1",
      "priority": "High",
      "cveCount": 3,
      "exploitedCveCount": 0
    }
  ],
  "noFixYet": [
    {
      "cveId": "CVE-2026-115557",
      "url": "https://patchblox.com/security/cve/CVE-2026-115557",
      "title": "Distrust compromised intermediate certificates in ssl module",
      "priority": "Urgent",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-19445",
      "url": "https://patchblox.com/security/cve/CVE-2026-19445",
      "title": "Use-after-free of a server-side SSLContext when sni_callback switches contexts",
      "priority": "Urgent",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2024-12718",
      "url": "https://patchblox.com/security/cve/CVE-2024-12718",
      "title": "Bypass extraction filter to modify file metadata outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-12084",
      "url": "https://patchblox.com/security/cve/CVE-2025-12084",
      "title": "Quadratic complexity in node ID cache clearing",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-13836",
      "url": "https://patchblox.com/security/cve/CVE-2025-13836",
      "title": "Excessive read buffering DoS in http.client",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-13837",
      "url": "https://patchblox.com/security/cve/CVE-2025-13837",
      "title": "Out-of-memory when loading Plist",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-15282",
      "url": "https://patchblox.com/security/cve/CVE-2025-15282",
      "title": "Header injection via newlines in data URL mediatype",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-15366",
      "url": "https://patchblox.com/security/cve/CVE-2025-15366",
      "title": "IMAP command injection in user-controlled commands",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-15367",
      "url": "https://patchblox.com/security/cve/CVE-2025-15367",
      "title": "POP3 command injection in user-controlled commands",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-4138",
      "url": "https://patchblox.com/security/cve/CVE-2025-4138",
      "title": "Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-4330",
      "url": "https://patchblox.com/security/cve/CVE-2025-4330",
      "title": "Extraction filter bypass for linking outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-4435",
      "url": "https://patchblox.com/security/cve/CVE-2025-4435",
      "title": "Tarfile extracts filtered members when errorlevel=0",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-4516",
      "url": "https://patchblox.com/security/cve/CVE-2025-4516",
      "title": "Use-after-free in \u0022unicode_escape\u0022 decoder with error handler",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-4517",
      "url": "https://patchblox.com/security/cve/CVE-2025-4517",
      "title": "Arbitrary writes via tarfile realpath overflow",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-8194",
      "url": "https://patchblox.com/security/cve/CVE-2025-8194",
      "title": "Tarfile infinite loop during parsing with negative member offset",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-8291",
      "url": "https://patchblox.com/security/cve/CVE-2025-8291",
      "title": "ZIP64 End of Central Directory (EOCD) Locator record offset not checked",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-0672",
      "url": "https://patchblox.com/security/cve/CVE-2026-0672",
      "title": "Header injection in http.cookies.Morsel",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-0865",
      "url": "https://patchblox.com/security/cve/CVE-2026-0865",
      "title": "wsgiref.headers.Headers allows header newline injection",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-11940",
      "url": "https://patchblox.com/security/cve/CVE-2026-11940",
      "title": "tarfile extraction filter bypass allows escaping the destination directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-11972",
      "url": "https://patchblox.com/security/cve/CVE-2026-11972",
      "title": "tarfile opened in streaming mode mishandles EOF",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-12345",
      "url": "https://patchblox.com/security/cve/CVE-2026-12345",
      "title": "Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-1299",
      "url": "https://patchblox.com/security/cve/CVE-2026-1299",
      "title": "email BytesGenerator header injection due to unquoted newlines",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-1502",
      "url": "https://patchblox.com/security/cve/CVE-2026-1502",
      "title": "HTTP client proxy tunnel headers not validated for CR/LF",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-15308",
      "url": "https://patchblox.com/security/cve/CVE-2026-15308",
      "title": "Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-19553",
      "url": "https://patchblox.com/security/cve/CVE-2026-19553",
      "title": "SSLContext.wrap_bio() missing validation of server_hostname parameter",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-2297",
      "url": "https://patchblox.com/security/cve/CVE-2026-2297",
      "title": "SourcelessFileLoader does not use io.open_code()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-3298",
      "url": "https://patchblox.com/security/cve/CVE-2026-3298",
      "title": "Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-3644",
      "url": "https://patchblox.com/security/cve/CVE-2026-3644",
      "title": "Incomplete control character validation in http.cookies",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-4519",
      "url": "https://patchblox.com/security/cve/CVE-2026-4519",
      "title": "webbrowser.open() allows leading dashes in URLs",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-4786",
      "url": "https://patchblox.com/security/cve/CVE-2026-4786",
      "title": "Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-6019",
      "url": "https://patchblox.com/security/cve/CVE-2026-6019",
      "title": "BaseCookie.js_output() does not neutralize embedded characters",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-6100",
      "url": "https://patchblox.com/security/cve/CVE-2026-6100",
      "title": "Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-7210",
      "url": "https://patchblox.com/security/cve/CVE-2026-7210",
      "title": "The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-82049",
      "url": "https://patchblox.com/security/cve/CVE-2026-82049",
      "title": "tarfile extraction filters allow file modification and content disclosure via hard link to symlink",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-9669",
      "url": "https://patchblox.com/security/cve/CVE-2026-9669",
      "title": "bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2024-3220",
      "url": "https://patchblox.com/security/cve/CVE-2024-3220",
      "title": "Default mimetype known files writeable on Windows",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-11468",
      "url": "https://patchblox.com/security/cve/CVE-2025-11468",
      "title": "Folding email comments of unfoldable characters doesn\u0027t preserve parenthesis",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-12781",
      "url": "https://patchblox.com/security/cve/CVE-2025-12781",
      "title": "base64.b64decode() always accepts \u0022\u002B/\u0022 characters, despite setting altchars",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2025-13462",
      "url": "https://patchblox.com/security/cve/CVE-2025-13462",
      "title": "tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-0864",
      "url": "https://patchblox.com/security/cve/CVE-2026-0864",
      "title": "Configuration Injection via Carriage Return (\\r) in write() method",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-103995",
      "url": "https://patchblox.com/security/cve/CVE-2026-103995",
      "title": "Lenient parsing of integers for response body and chunk framing",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-114583",
      "url": "https://patchblox.com/security/cve/CVE-2026-114583",
      "title": "tar filter allows writing outside destination via empty-named symlink",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-116566",
      "url": "https://patchblox.com/security/cve/CVE-2026-116566",
      "title": "socket.getaddrinfo() accepts embedded null bytes in host and port",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-12003",
      "url": "https://patchblox.com/security/cve/CVE-2026-12003",
      "title": "CPython \u003E3.11 Insecure Input Validation resulting in privilege escalation",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-15310",
      "url": "https://patchblox.com/security/cve/CVE-2026-15310",
      "title": "zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-15806",
      "url": "https://patchblox.com/security/cve/CVE-2026-15806",
      "title": "\u0060HTTPPasswordMgr\u0060 can send saved HTTPS credentials via HTTP because of incorrect scheme matching",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-17084",
      "url": "https://patchblox.com/security/cve/CVE-2026-17084",
      "title": "stringprep.map_table_b2() deviates from RFC 3454 Table B.2",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-18503",
      "url": "https://patchblox.com/security/cve/CVE-2026-18503",
      "title": "Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-19672",
      "url": "https://patchblox.com/security/cve/CVE-2026-19672",
      "title": "tarfile extraction filter bypass allows creation of directories outside the destination",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-3087",
      "url": "https://patchblox.com/security/cve/CVE-2026-3087",
      "title": "shutil.unpack_archive() doesn\u0027t check for Windows absolute paths in ZIPs",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-3276",
      "url": "https://patchblox.com/security/cve/CVE-2026-3276",
      "title": "Potential DoS via quadratic complexity in unicodedata.normalize()",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-3446",
      "url": "https://patchblox.com/security/cve/CVE-2026-3446",
      "title": "Base64 decoding stops at first padded quad by default",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-3479",
      "url": "https://patchblox.com/security/cve/CVE-2026-3479",
      "title": "pkgutil.get_data() does not enforce documented restrictions",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-6879",
      "url": "https://patchblox.com/security/cve/CVE-2026-6879",
      "title": "Quadratic Behavior in xml.etree.ElementPath Index Predicates",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-7774",
      "url": "https://patchblox.com/security/cve/CVE-2026-7774",
      "title": "tarfile.data_filter path traversal bypass allows writing outside the extraction directory",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-8328",
      "url": "https://patchblox.com/security/cve/CVE-2026-8328",
      "title": "FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    },
    {
      "cveId": "CVE-2026-87910",
      "url": "https://patchblox.com/security/cve/CVE-2026-87910",
      "title": "tarfile hardlink fallback ignores custom extraction filter rejection via None",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.12.10"
    }
  ],
  "dataAsOf": "2026-11-07T12:40:37Z"
}