# Python 3.7 security updates

The latest version of Python 3.7 is 3.7.9, released August 15, 2020. Patch Radar has 7 security fixes for Python 3.7, closing 22 CVEs. The newest security fix is Python 3.7 3.7.9, released August 15, 2020. 102 CVEs have no fix yet.

- Web page: https://patchblox.com/security/product/windows-app/python-3.7
- Platform: Windows apps
- Vendor: Python Software Foundation
- Latest version: 3.7.9 (Aug 15, 2020)
- Supported: yes

## CVEs with no fix yet

| CVE | Priority | Title | Status |
|---|---|---|---|
| [CVE-2026-115557](https://patchblox.com/security/data/cve/CVE-2026-115557.md) | Urgent | Distrust compromised intermediate certificates in ssl module | no-fix |
| [CVE-2026-19445](https://patchblox.com/security/data/cve/CVE-2026-19445.md) | Urgent | Use-after-free of a server-side SSLContext when sni_callback switches contexts | no-fix |
| [CVE-2007-4559](https://patchblox.com/security/data/cve/CVE-2007-4559.md) | High | Python 3.10 and 8 others: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | no-fix |
| [CVE-2015-20107](https://patchblox.com/security/data/cve/CVE-2015-20107.md) | High | Python 3.8 and 4 others: Improper Neutralization of Special Elements used in a Command ('Command Injection') | no-fix |
| [CVE-2018-25032](https://patchblox.com/security/data/cve/CVE-2018-25032.md) | High | Python 3.8 and 4 others: Out-of-bounds Write | no-fix |
| [CVE-2019-12900](https://patchblox.com/security/data/cve/CVE-2019-12900.md) | High | Python 3.8 and 4 others: Out-of-bounds Write | no-fix |
| [CVE-2019-9674](https://patchblox.com/security/data/cve/CVE-2019-9674.md) | High | Python 3.7 and 3 others: Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource… | no-fix |
| [CVE-2020-10735](https://patchblox.com/security/data/cve/CVE-2020-10735.md) | High | Python 3.8 and 5 others: Incorrect Type Conversion or Cast | no-fix |
| [CVE-2020-27619](https://patchblox.com/security/data/cve/CVE-2020-27619.md) | High | Python 3.7 and 3 others: In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content… | no-fix |
| [CVE-2021-23336](https://patchblox.com/security/data/cve/CVE-2021-23336.md) | High | Web Cache Poisoning | no-fix |
| [CVE-2021-28861](https://patchblox.com/security/data/cve/CVE-2021-28861.md) | High | Python 3.8 and 7 others: URL Redirection to Untrusted Site ('Open Redirect') | no-fix |
| [CVE-2021-3177](https://patchblox.com/security/data/cve/CVE-2021-3177.md) | High | Python 3.7 and 2 others: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | no-fix |
| [CVE-2021-3426](https://patchblox.com/security/data/cve/CVE-2021-3426.md) | High | Python 3.7 and 3 others: There's a flaw in Python 3's pydoc. | no-fix |
| [CVE-2021-3733](https://patchblox.com/security/data/cve/CVE-2021-3733.md) | High | Python 3.7 and 5 others: Uncontrolled Resource Consumption | no-fix |
| [CVE-2021-3737](https://patchblox.com/security/data/cve/CVE-2021-3737.md) | High | Python 3.8 and 2 others: Loop with Unreachable Exit Condition ('Infinite Loop'), CWE-400 - Uncontrolled Resource Consumption | no-fix |
| [CVE-2021-4189](https://patchblox.com/security/data/cve/CVE-2021-4189.md) | High | Python 3.7 and 3 others: Unchecked Return Value | no-fix |
| [CVE-2022-0391](https://patchblox.com/security/data/cve/CVE-2022-0391.md) | High | Python 3.8 and 5 others: A flaw was found in Python, specifically within the urllib.parse module. | no-fix |
| [CVE-2022-26488](https://patchblox.com/security/data/cve/CVE-2022-26488.md) | High | Python 3.8 and 8 others: In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately… | no-fix |
| [CVE-2022-37454](https://patchblox.com/security/data/cve/CVE-2022-37454.md) | High | Python 3.8 and 5 others: Integer Overflow or Wraparound | no-fix |
| [CVE-2022-42919](https://patchblox.com/security/data/cve/CVE-2022-42919.md) | High | Python 3.10 and 4 others: Deserialization of Untrusted Data | no-fix |
| [CVE-2022-48565](https://patchblox.com/security/data/cve/CVE-2022-48565.md) | High | Python 3.7 and 4 others: An XML External Entity (XXE) issue was discovered in Python through 3.9.1. | no-fix |
| [CVE-2023-24329](https://patchblox.com/security/data/cve/CVE-2023-24329.md) | High | Python 3.10 and 8 others: Improper Input Validation | no-fix |
| [CVE-2023-36632](https://patchblox.com/security/data/cve/CVE-2023-36632.md) | High | Python 3.10 and 8 others: The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError:… | no-fix |
| [CVE-2023-40217](https://patchblox.com/security/data/cve/CVE-2023-40217.md) | High | Python 3.10 and 8 others: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x… | no-fix |
| [CVE-2023-6597](https://patchblox.com/security/data/cve/CVE-2023-6597.md) | High | Python 3.10 and 9 others: An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,… | no-fix |
| [CVE-2024-0397](https://patchblox.com/security/data/cve/CVE-2024-0397.md) | High | Memory race condition in ssl.SSLContext certificate store methods | no-fix |
| [CVE-2024-11168](https://patchblox.com/security/data/cve/CVE-2024-11168.md) | High | Improper validation of IPv6 and IPvFuture addresses | no-fix |
| [CVE-2024-12254](https://patchblox.com/security/data/cve/CVE-2024-12254.md) | High | Unbounded memory buffering in SelectorSocketTransport.writelines() | no-fix |
| [CVE-2024-12718](https://patchblox.com/security/data/cve/CVE-2024-12718.md) | High | Bypass extraction filter to modify file metadata outside extraction directory | no-fix |
| [CVE-2024-4030](https://patchblox.com/security/data/cve/CVE-2024-4030.md) | High | tempfile.mkdtemp() may be readable and writeable by all users on Windows | no-fix |
| [CVE-2024-4032](https://patchblox.com/security/data/cve/CVE-2024-4032.md) | High | Incorrect IPv4 and IPv6 private ranges | no-fix |
| [CVE-2024-5642](https://patchblox.com/security/data/cve/CVE-2024-5642.md) | High | Buffer overread when using an empty list with SSLContext.set_npn_protocols() | no-fix |
| [CVE-2024-6232](https://patchblox.com/security/data/cve/CVE-2024-6232.md) | High | Regular-expression DoS when parsing TarFile headers | no-fix |
| [CVE-2024-6923](https://patchblox.com/security/data/cve/CVE-2024-6923.md) | High | Email header injection due to unquoted newlines | no-fix |
| [CVE-2024-7592](https://patchblox.com/security/data/cve/CVE-2024-7592.md) | High | Quadratic complexity parsing cookies with backslashes | no-fix |
| [CVE-2024-8088](https://patchblox.com/security/data/cve/CVE-2024-8088.md) | High | Infinite loop when iterating over zip archive entry names from zipfile.Path | no-fix |
| [CVE-2024-9287](https://patchblox.com/security/data/cve/CVE-2024-9287.md) | High | Virtual environment (venv) activation scripts don't quote paths | no-fix |
| [CVE-2025-0938](https://patchblox.com/security/data/cve/CVE-2025-0938.md) | High | URL parser allowed square brackets in domain names | no-fix |
| [CVE-2025-12084](https://patchblox.com/security/data/cve/CVE-2025-12084.md) | High | Quadratic complexity in node ID cache clearing | no-fix |
| [CVE-2025-13836](https://patchblox.com/security/data/cve/CVE-2025-13836.md) | High | Excessive read buffering DoS in http.client | no-fix |
| [CVE-2025-13837](https://patchblox.com/security/data/cve/CVE-2025-13837.md) | High | Out-of-memory when loading Plist | no-fix |
| [CVE-2025-15282](https://patchblox.com/security/data/cve/CVE-2025-15282.md) | High | Header injection via newlines in data URL mediatype | no-fix |
| [CVE-2025-15366](https://patchblox.com/security/data/cve/CVE-2025-15366.md) | High | IMAP command injection in user-controlled commands | no-fix |
| [CVE-2025-15367](https://patchblox.com/security/data/cve/CVE-2025-15367.md) | High | POP3 command injection in user-controlled commands | no-fix |
| [CVE-2025-4138](https://patchblox.com/security/data/cve/CVE-2025-4138.md) | High | Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory | no-fix |
| [CVE-2025-4330](https://patchblox.com/security/data/cve/CVE-2025-4330.md) | High | Extraction filter bypass for linking outside extraction directory | no-fix |
| [CVE-2025-4435](https://patchblox.com/security/data/cve/CVE-2025-4435.md) | High | Tarfile extracts filtered members when errorlevel=0 | no-fix |
| [CVE-2025-4516](https://patchblox.com/security/data/cve/CVE-2025-4516.md) | High | Use-after-free in "unicode_escape" decoder with error handler | no-fix |
| [CVE-2025-4517](https://patchblox.com/security/data/cve/CVE-2025-4517.md) | High | Arbitrary writes via tarfile realpath overflow | no-fix |
| [CVE-2025-6075](https://patchblox.com/security/data/cve/CVE-2025-6075.md) | High | Quadratic complexity in os.path.expandvars() with user-controlled template | no-fix |
| [CVE-2025-8194](https://patchblox.com/security/data/cve/CVE-2025-8194.md) | High | Tarfile infinite loop during parsing with negative member offset | no-fix |
| [CVE-2025-8291](https://patchblox.com/security/data/cve/CVE-2025-8291.md) | High | ZIP64 End of Central Directory (EOCD) Locator record offset not checked | no-fix |
| [CVE-2026-0672](https://patchblox.com/security/data/cve/CVE-2026-0672.md) | High | Header injection in http.cookies.Morsel | no-fix |
| [CVE-2026-0865](https://patchblox.com/security/data/cve/CVE-2026-0865.md) | High | wsgiref.headers.Headers allows header newline injection | no-fix |
| [CVE-2026-11940](https://patchblox.com/security/data/cve/CVE-2026-11940.md) | High | tarfile extraction filter bypass allows escaping the destination directory | no-fix |
| [CVE-2026-11972](https://patchblox.com/security/data/cve/CVE-2026-11972.md) | High | tarfile opened in streaming mode mishandles EOF | no-fix |
| [CVE-2026-12345](https://patchblox.com/security/data/cve/CVE-2026-12345.md) | High | Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory | no-fix |
| [CVE-2026-1299](https://patchblox.com/security/data/cve/CVE-2026-1299.md) | High | email BytesGenerator header injection due to unquoted newlines | no-fix |
| [CVE-2026-1502](https://patchblox.com/security/data/cve/CVE-2026-1502.md) | High | HTTP client proxy tunnel headers not validated for CR/LF | no-fix |
| [CVE-2026-15308](https://patchblox.com/security/data/cve/CVE-2026-15308.md) | High | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | no-fix |
| [CVE-2026-19553](https://patchblox.com/security/data/cve/CVE-2026-19553.md) | High | SSLContext.wrap_bio() missing validation of server_hostname parameter | no-fix |
| [CVE-2026-2297](https://patchblox.com/security/data/cve/CVE-2026-2297.md) | High | SourcelessFileLoader does not use io.open_code() | no-fix |
| [CVE-2026-3298](https://patchblox.com/security/data/cve/CVE-2026-3298.md) | High | Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes | no-fix |
| [CVE-2026-3644](https://patchblox.com/security/data/cve/CVE-2026-3644.md) | High | Incomplete control character validation in http.cookies | no-fix |
| [CVE-2026-4224](https://patchblox.com/security/data/cve/CVE-2026-4224.md) | High | Stack overflow parsing XML with deeply nested DTD content models | no-fix |
| [CVE-2026-4519](https://patchblox.com/security/data/cve/CVE-2026-4519.md) | High | webbrowser.open() allows leading dashes in URLs | no-fix |
| [CVE-2026-4786](https://patchblox.com/security/data/cve/CVE-2026-4786.md) | High | Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() | no-fix |
| [CVE-2026-6019](https://patchblox.com/security/data/cve/CVE-2026-6019.md) | High | BaseCookie.js_output() does not neutralize embedded characters | no-fix |
| [CVE-2026-6100](https://patchblox.com/security/data/cve/CVE-2026-6100.md) | High | Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure | no-fix |
| [CVE-2026-7210](https://patchblox.com/security/data/cve/CVE-2026-7210.md) | High | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | no-fix |
| [CVE-2026-82049](https://patchblox.com/security/data/cve/CVE-2026-82049.md) | High | tarfile extraction filters allow file modification and content disclosure via hard link to symlink | no-fix |
| [CVE-2026-9669](https://patchblox.com/security/data/cve/CVE-2026-9669.md) | High | bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow | no-fix |
| [CVE-2013-0340](https://patchblox.com/security/data/cve/CVE-2013-0340.md) | Routine | Python 3.8 and 3 others: expat before version 2.4.0 does not properly handle entities expansion unless an application developer… | no-fix |
| [CVE-2016-3189](https://patchblox.com/security/data/cve/CVE-2016-3189.md) | Routine | Python 3.8 and 4 others: Use After Free | no-fix |
| [CVE-2022-48564](https://patchblox.com/security/data/cve/CVE-2022-48564.md) | Routine | Python 3.7 and 4 others: read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and… | no-fix |
| [CVE-2022-48566](https://patchblox.com/security/data/cve/CVE-2022-48566.md) | Routine | Python 3.7 and 4 others: An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. | no-fix |
| [CVE-2023-27043](https://patchblox.com/security/data/cve/CVE-2023-27043.md) | Routine | Python 3.10 and 8 others: Improper Input Validation | no-fix |
| [CVE-2024-0450](https://patchblox.com/security/data/cve/CVE-2024-0450.md) | Routine | Quoted zip-bomb protection for zipfile | no-fix |
| [CVE-2024-3219](https://patchblox.com/security/data/cve/CVE-2024-3219.md) | Routine | Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection | no-fix |
| [CVE-2024-3220](https://patchblox.com/security/data/cve/CVE-2024-3220.md) | Routine | Default mimetype known files writeable on Windows | no-fix |
| [CVE-2025-11468](https://patchblox.com/security/data/cve/CVE-2025-11468.md) | Routine | Folding email comments of unfoldable characters doesn't preserve parenthesis | no-fix |
| [CVE-2025-12781](https://patchblox.com/security/data/cve/CVE-2025-12781.md) | Routine | base64.b64decode() always accepts "+/" characters, despite setting altchars | no-fix |
| [CVE-2025-13462](https://patchblox.com/security/data/cve/CVE-2025-13462.md) | Routine | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling | no-fix |
| [CVE-2025-1795](https://patchblox.com/security/data/cve/CVE-2025-1795.md) | Routine | Mishandling of comma during folding and unicode-encoding of email headers | no-fix |
| [CVE-2026-0864](https://patchblox.com/security/data/cve/CVE-2026-0864.md) | Routine | Configuration Injection via Carriage Return (\r) in write() method | no-fix |
| [CVE-2026-103995](https://patchblox.com/security/data/cve/CVE-2026-103995.md) | Routine | Lenient parsing of integers for response body and chunk framing | no-fix |
| [CVE-2026-114583](https://patchblox.com/security/data/cve/CVE-2026-114583.md) | Routine | tar filter allows writing outside destination via empty-named symlink | no-fix |
| [CVE-2026-116566](https://patchblox.com/security/data/cve/CVE-2026-116566.md) | Routine | socket.getaddrinfo() accepts embedded null bytes in host and port | no-fix |
| [CVE-2026-12003](https://patchblox.com/security/data/cve/CVE-2026-12003.md) | Routine | CPython >3.11 Insecure Input Validation resulting in privilege escalation | no-fix |
| [CVE-2026-15310](https://patchblox.com/security/data/cve/CVE-2026-15310.md) | Routine | zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits | no-fix |
| [CVE-2026-15806](https://patchblox.com/security/data/cve/CVE-2026-15806.md) | Routine | `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | no-fix |
| [CVE-2026-17084](https://patchblox.com/security/data/cve/CVE-2026-17084.md) | Routine | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | no-fix |
| [CVE-2026-18503](https://patchblox.com/security/data/cve/CVE-2026-18503.md) | Routine | Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() | no-fix |
| [CVE-2026-19672](https://patchblox.com/security/data/cve/CVE-2026-19672.md) | Routine | tarfile extraction filter bypass allows creation of directories outside the destination | no-fix |
| [CVE-2026-3087](https://patchblox.com/security/data/cve/CVE-2026-3087.md) | Routine | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs | no-fix |
| [CVE-2026-3276](https://patchblox.com/security/data/cve/CVE-2026-3276.md) | Routine | Potential DoS via quadratic complexity in unicodedata.normalize() | no-fix |
| [CVE-2026-3446](https://patchblox.com/security/data/cve/CVE-2026-3446.md) | Routine | Base64 decoding stops at first padded quad by default | no-fix |
| [CVE-2026-3479](https://patchblox.com/security/data/cve/CVE-2026-3479.md) | Routine | pkgutil.get_data() does not enforce documented restrictions | no-fix |
| [CVE-2026-6879](https://patchblox.com/security/data/cve/CVE-2026-6879.md) | Routine | Quadratic Behavior in xml.etree.ElementPath Index Predicates | no-fix |
| [CVE-2026-7774](https://patchblox.com/security/data/cve/CVE-2026-7774.md) | Routine | tarfile.data_filter path traversal bypass allows writing outside the extraction directory | no-fix |
| [CVE-2026-8328](https://patchblox.com/security/data/cve/CVE-2026-8328.md) | Routine | FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address | no-fix |
| [CVE-2026-87910](https://patchblox.com/security/data/cve/CVE-2026-87910.md) | Routine | tarfile hardlink fallback ignores custom extraction filter rejection via None | no-fix |

## Security fixes, newest first

| Fix | Released | Fixed in | Priority | CVEs | Exploited |
|---|---|---|---|---:|---:|
| [Python 3.7 3.7.9](https://patchblox.com/security/data/fix/windows-app/python.python.3.7-3.7.9.md) | Aug 15, 2020 | 3.7.9 | Urgent | 5 | 0 |
| [Python 3.7 3.7.8](https://patchblox.com/security/data/fix/windows-app/python.python.3.7-3.7.8.md) | Jun 27, 2020 | 3.7.8 | Routine | 1 | 0 |
| [Python 3.7 3.7.7](https://patchblox.com/security/data/fix/windows-app/python.python.3.7-3.7.7.md) | Mar 10, 2020 | 3.7.7 | High | 3 | 0 |
| [Python 3.7 3.7.5](https://patchblox.com/security/data/fix/windows-app/python.python.3.7-3.7.5.md) | Oct 14, 2019 | 3.7.5 | High | 3 | 0 |
| [Python 3.7 3.7.4](https://patchblox.com/security/data/fix/windows-app/python.python.3.7-3.7.4.md) | Jul 8, 2019 | 3.7.4 | High | 3 | 0 |
| [Python 3.7 3.7.3](https://patchblox.com/security/data/fix/windows-app/python.python.3.7-3.7.3.md) | Mar 25, 2019 | 3.7.3 | High | 2 | 0 |
| [Python 3.7 3.7.1](https://patchblox.com/security/data/fix/windows-app/python.python.3.7-3.7.1.md) | Oct 20, 2018 | 3.7.1 | High | 5 | 0 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.