{
  "product": "Python 3.8",
  "url": "https://patchblox.com/security/product/windows-app/python-3.8",
  "summary": "The latest version of Python 3.8 is 3.8.10, released May 3, 2021. Patch Radar has 9 security fixes for Python 3.8, closing 20 CVEs. The newest security fix is Python 3.8 3.8.10, released May 3, 2021. 93 CVEs have no fix yet.",
  "platform": "windows-app",
  "vendor": "Python Software Foundation",
  "supported": true,
  "latestVersion": "3.8.10",
  "latestReleased": "2021-05-03T00:00:00Z",
  "fixCount": 9,
  "cveCount": 20,
  "exploitedCveCount": 0,
  "unfixedCveCount": 93,
  "fixes": [
    {
      "fix": "Python 3.8 3.8.10",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.8-3.8.10",
      "released": "2021-05-03T00:00:00Z",
      "fixedVersion": "3.8.10",
      "priority": "High",
      "cveCount": 1,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.8 3.8.9",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.8-3.8.9",
      "released": "2021-04-02T00:00:00Z",
      "fixedVersion": "3.8.9",
      "priority": "High",
      "cveCount": 1,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.8 3.8.8",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.8-3.8.8",
      "released": "2021-02-19T00:00:00Z",
      "fixedVersion": "3.8.8",
      "priority": "High",
      "cveCount": 3,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.8 3.8.7",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.8-3.8.7",
      "released": "2020-12-21T00:00:00Z",
      "fixedVersion": "3.8.7",
      "priority": "High",
      "cveCount": 4,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.8 3.8.5",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.8-3.8.5",
      "released": "2020-07-20T00:00:00Z",
      "fixedVersion": "3.8.5",
      "priority": "Urgent",
      "cveCount": 4,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.8 3.8.4",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.8-3.8.4",
      "released": "2020-07-13T00:00:00Z",
      "fixedVersion": "3.8.4",
      "priority": "Routine",
      "cveCount": 1,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.8 3.8.3",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.8-3.8.3",
      "released": "2020-05-13T00:00:00Z",
      "fixedVersion": "3.8.3",
      "priority": "Routine",
      "cveCount": 1,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.8 3.8.2",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.8-3.8.2",
      "released": "2020-02-24T00:00:00Z",
      "fixedVersion": "3.8.2",
      "priority": "High",
      "cveCount": 3,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.8 3.8.1",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.8-3.8.1",
      "released": "2019-12-18T00:00:00Z",
      "fixedVersion": "3.8.1",
      "priority": "High",
      "cveCount": 2,
      "exploitedCveCount": 0
    }
  ],
  "noFixYet": [
    {
      "cveId": "CVE-2026-115557",
      "url": "https://patchblox.com/security/cve/CVE-2026-115557",
      "title": "Distrust compromised intermediate certificates in ssl module",
      "priority": "Urgent",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-19445",
      "url": "https://patchblox.com/security/cve/CVE-2026-19445",
      "title": "Use-after-free of a server-side SSLContext when sni_callback switches contexts",
      "priority": "Urgent",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2007-4559",
      "url": "https://patchblox.com/security/cve/CVE-2007-4559",
      "title": "Python 3.10 and 8 others: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2015-20107",
      "url": "https://patchblox.com/security/cve/CVE-2015-20107",
      "title": "Python 3.8 and 4 others: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2018-25032",
      "url": "https://patchblox.com/security/cve/CVE-2018-25032",
      "title": "Python 3.8 and 4 others: Out-of-bounds Write",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2019-12900",
      "url": "https://patchblox.com/security/cve/CVE-2019-12900",
      "title": "Python 3.8 and 4 others: Out-of-bounds Write",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2020-10735",
      "url": "https://patchblox.com/security/cve/CVE-2020-10735",
      "title": "Python 3.8 and 5 others: Incorrect Type Conversion or Cast",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2021-28861",
      "url": "https://patchblox.com/security/cve/CVE-2021-28861",
      "title": "Python 3.8 and 7 others: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2021-29921",
      "url": "https://patchblox.com/security/cve/CVE-2021-29921",
      "title": "Python 3.8: In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2021-3737",
      "url": "https://patchblox.com/security/cve/CVE-2021-3737",
      "title": "Python 3.8 and 2 others: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027), CWE-400 - Uncontrolled Resource Consumption",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2022-0391",
      "url": "https://patchblox.com/security/cve/CVE-2022-0391",
      "title": "Python 3.8 and 5 others: A flaw was found in Python, specifically within the urllib.parse module.",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2022-26488",
      "url": "https://patchblox.com/security/cve/CVE-2022-26488",
      "title": "Python 3.8 and 8 others: In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2022-37454",
      "url": "https://patchblox.com/security/cve/CVE-2022-37454",
      "title": "Python 3.8 and 5 others: Integer Overflow or Wraparound",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2022-42919",
      "url": "https://patchblox.com/security/cve/CVE-2022-42919",
      "title": "Python 3.10 and 4 others: Deserialization of Untrusted Data",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2023-24329",
      "url": "https://patchblox.com/security/cve/CVE-2023-24329",
      "title": "Python 3.10 and 8 others: Improper Input Validation",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2023-36632",
      "url": "https://patchblox.com/security/cve/CVE-2023-36632",
      "title": "Python 3.10 and 8 others: The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \u0022RecursionError:\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2023-40217",
      "url": "https://patchblox.com/security/cve/CVE-2023-40217",
      "title": "Python 3.10 and 8 others: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2023-6597",
      "url": "https://patchblox.com/security/cve/CVE-2023-6597",
      "title": "Python 3.10 and 9 others: An issue was found in the CPython \u0060tempfile.TemporaryDirectory\u0060 class affecting versions 3.12.1, 3.11.7,\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-0397",
      "url": "https://patchblox.com/security/cve/CVE-2024-0397",
      "title": "Memory race condition in ssl.SSLContext certificate store methods",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-11168",
      "url": "https://patchblox.com/security/cve/CVE-2024-11168",
      "title": "Improper validation of IPv6 and IPvFuture addresses",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-12254",
      "url": "https://patchblox.com/security/cve/CVE-2024-12254",
      "title": "Unbounded memory buffering in SelectorSocketTransport.writelines()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-12718",
      "url": "https://patchblox.com/security/cve/CVE-2024-12718",
      "title": "Bypass extraction filter to modify file metadata outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-4030",
      "url": "https://patchblox.com/security/cve/CVE-2024-4030",
      "title": "tempfile.mkdtemp() may be readable and writeable by all users on Windows",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-4032",
      "url": "https://patchblox.com/security/cve/CVE-2024-4032",
      "title": "Incorrect IPv4 and IPv6 private ranges",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-5642",
      "url": "https://patchblox.com/security/cve/CVE-2024-5642",
      "title": "Buffer overread when using an empty list with SSLContext.set_npn_protocols()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-6232",
      "url": "https://patchblox.com/security/cve/CVE-2024-6232",
      "title": "Regular-expression DoS when parsing TarFile headers",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-6923",
      "url": "https://patchblox.com/security/cve/CVE-2024-6923",
      "title": "Email header injection due to unquoted newlines",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-7592",
      "url": "https://patchblox.com/security/cve/CVE-2024-7592",
      "title": "Quadratic complexity parsing cookies with backslashes",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-8088",
      "url": "https://patchblox.com/security/cve/CVE-2024-8088",
      "title": "Infinite loop when iterating over zip archive entry names from zipfile.Path",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-9287",
      "url": "https://patchblox.com/security/cve/CVE-2024-9287",
      "title": "Virtual environment (venv) activation scripts don\u0027t quote paths",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-0938",
      "url": "https://patchblox.com/security/cve/CVE-2025-0938",
      "title": "URL parser allowed square brackets in domain names",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-12084",
      "url": "https://patchblox.com/security/cve/CVE-2025-12084",
      "title": "Quadratic complexity in node ID cache clearing",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-13836",
      "url": "https://patchblox.com/security/cve/CVE-2025-13836",
      "title": "Excessive read buffering DoS in http.client",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-13837",
      "url": "https://patchblox.com/security/cve/CVE-2025-13837",
      "title": "Out-of-memory when loading Plist",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-15282",
      "url": "https://patchblox.com/security/cve/CVE-2025-15282",
      "title": "Header injection via newlines in data URL mediatype",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-15366",
      "url": "https://patchblox.com/security/cve/CVE-2025-15366",
      "title": "IMAP command injection in user-controlled commands",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-15367",
      "url": "https://patchblox.com/security/cve/CVE-2025-15367",
      "title": "POP3 command injection in user-controlled commands",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-4138",
      "url": "https://patchblox.com/security/cve/CVE-2025-4138",
      "title": "Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-4330",
      "url": "https://patchblox.com/security/cve/CVE-2025-4330",
      "title": "Extraction filter bypass for linking outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-4435",
      "url": "https://patchblox.com/security/cve/CVE-2025-4435",
      "title": "Tarfile extracts filtered members when errorlevel=0",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-4516",
      "url": "https://patchblox.com/security/cve/CVE-2025-4516",
      "title": "Use-after-free in \u0022unicode_escape\u0022 decoder with error handler",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-4517",
      "url": "https://patchblox.com/security/cve/CVE-2025-4517",
      "title": "Arbitrary writes via tarfile realpath overflow",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-6075",
      "url": "https://patchblox.com/security/cve/CVE-2025-6075",
      "title": "Quadratic complexity in os.path.expandvars() with user-controlled template",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-8194",
      "url": "https://patchblox.com/security/cve/CVE-2025-8194",
      "title": "Tarfile infinite loop during parsing with negative member offset",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-8291",
      "url": "https://patchblox.com/security/cve/CVE-2025-8291",
      "title": "ZIP64 End of Central Directory (EOCD) Locator record offset not checked",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-0672",
      "url": "https://patchblox.com/security/cve/CVE-2026-0672",
      "title": "Header injection in http.cookies.Morsel",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-0865",
      "url": "https://patchblox.com/security/cve/CVE-2026-0865",
      "title": "wsgiref.headers.Headers allows header newline injection",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-11940",
      "url": "https://patchblox.com/security/cve/CVE-2026-11940",
      "title": "tarfile extraction filter bypass allows escaping the destination directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-11972",
      "url": "https://patchblox.com/security/cve/CVE-2026-11972",
      "title": "tarfile opened in streaming mode mishandles EOF",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-12345",
      "url": "https://patchblox.com/security/cve/CVE-2026-12345",
      "title": "Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-1299",
      "url": "https://patchblox.com/security/cve/CVE-2026-1299",
      "title": "email BytesGenerator header injection due to unquoted newlines",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-1502",
      "url": "https://patchblox.com/security/cve/CVE-2026-1502",
      "title": "HTTP client proxy tunnel headers not validated for CR/LF",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-15308",
      "url": "https://patchblox.com/security/cve/CVE-2026-15308",
      "title": "Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-19553",
      "url": "https://patchblox.com/security/cve/CVE-2026-19553",
      "title": "SSLContext.wrap_bio() missing validation of server_hostname parameter",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-2297",
      "url": "https://patchblox.com/security/cve/CVE-2026-2297",
      "title": "SourcelessFileLoader does not use io.open_code()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-3298",
      "url": "https://patchblox.com/security/cve/CVE-2026-3298",
      "title": "Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-3644",
      "url": "https://patchblox.com/security/cve/CVE-2026-3644",
      "title": "Incomplete control character validation in http.cookies",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-4224",
      "url": "https://patchblox.com/security/cve/CVE-2026-4224",
      "title": "Stack overflow parsing XML with deeply nested DTD content models",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-4519",
      "url": "https://patchblox.com/security/cve/CVE-2026-4519",
      "title": "webbrowser.open() allows leading dashes in URLs",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-4786",
      "url": "https://patchblox.com/security/cve/CVE-2026-4786",
      "title": "Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-6019",
      "url": "https://patchblox.com/security/cve/CVE-2026-6019",
      "title": "BaseCookie.js_output() does not neutralize embedded characters",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-6100",
      "url": "https://patchblox.com/security/cve/CVE-2026-6100",
      "title": "Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-7210",
      "url": "https://patchblox.com/security/cve/CVE-2026-7210",
      "title": "The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-82049",
      "url": "https://patchblox.com/security/cve/CVE-2026-82049",
      "title": "tarfile extraction filters allow file modification and content disclosure via hard link to symlink",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-9669",
      "url": "https://patchblox.com/security/cve/CVE-2026-9669",
      "title": "bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2013-0340",
      "url": "https://patchblox.com/security/cve/CVE-2013-0340",
      "title": "Python 3.8 and 3 others: expat before version 2.4.0 does not properly handle entities expansion unless an application developer\u2026",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2016-3189",
      "url": "https://patchblox.com/security/cve/CVE-2016-3189",
      "title": "Python 3.8 and 4 others: Use After Free",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2023-27043",
      "url": "https://patchblox.com/security/cve/CVE-2023-27043",
      "title": "Python 3.10 and 8 others: Improper Input Validation",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-0450",
      "url": "https://patchblox.com/security/cve/CVE-2024-0450",
      "title": "Quoted zip-bomb protection for zipfile",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-3219",
      "url": "https://patchblox.com/security/cve/CVE-2024-3219",
      "title": "Pure-Python fallback of socket.socketpair() doesn\u2019t authenticate peer connection",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2024-3220",
      "url": "https://patchblox.com/security/cve/CVE-2024-3220",
      "title": "Default mimetype known files writeable on Windows",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-11468",
      "url": "https://patchblox.com/security/cve/CVE-2025-11468",
      "title": "Folding email comments of unfoldable characters doesn\u0027t preserve parenthesis",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-12781",
      "url": "https://patchblox.com/security/cve/CVE-2025-12781",
      "title": "base64.b64decode() always accepts \u0022\u002B/\u0022 characters, despite setting altchars",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-13462",
      "url": "https://patchblox.com/security/cve/CVE-2025-13462",
      "title": "tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2025-1795",
      "url": "https://patchblox.com/security/cve/CVE-2025-1795",
      "title": "Mishandling of comma during folding and unicode-encoding of email headers",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-0864",
      "url": "https://patchblox.com/security/cve/CVE-2026-0864",
      "title": "Configuration Injection via Carriage Return (\\r) in write() method",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-103995",
      "url": "https://patchblox.com/security/cve/CVE-2026-103995",
      "title": "Lenient parsing of integers for response body and chunk framing",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-114583",
      "url": "https://patchblox.com/security/cve/CVE-2026-114583",
      "title": "tar filter allows writing outside destination via empty-named symlink",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-116566",
      "url": "https://patchblox.com/security/cve/CVE-2026-116566",
      "title": "socket.getaddrinfo() accepts embedded null bytes in host and port",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-12003",
      "url": "https://patchblox.com/security/cve/CVE-2026-12003",
      "title": "CPython \u003E3.11 Insecure Input Validation resulting in privilege escalation",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-15310",
      "url": "https://patchblox.com/security/cve/CVE-2026-15310",
      "title": "zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-15806",
      "url": "https://patchblox.com/security/cve/CVE-2026-15806",
      "title": "\u0060HTTPPasswordMgr\u0060 can send saved HTTPS credentials via HTTP because of incorrect scheme matching",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-17084",
      "url": "https://patchblox.com/security/cve/CVE-2026-17084",
      "title": "stringprep.map_table_b2() deviates from RFC 3454 Table B.2",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-18503",
      "url": "https://patchblox.com/security/cve/CVE-2026-18503",
      "title": "Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-19672",
      "url": "https://patchblox.com/security/cve/CVE-2026-19672",
      "title": "tarfile extraction filter bypass allows creation of directories outside the destination",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-3087",
      "url": "https://patchblox.com/security/cve/CVE-2026-3087",
      "title": "shutil.unpack_archive() doesn\u0027t check for Windows absolute paths in ZIPs",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-3276",
      "url": "https://patchblox.com/security/cve/CVE-2026-3276",
      "title": "Potential DoS via quadratic complexity in unicodedata.normalize()",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-3446",
      "url": "https://patchblox.com/security/cve/CVE-2026-3446",
      "title": "Base64 decoding stops at first padded quad by default",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-3479",
      "url": "https://patchblox.com/security/cve/CVE-2026-3479",
      "title": "pkgutil.get_data() does not enforce documented restrictions",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-6879",
      "url": "https://patchblox.com/security/cve/CVE-2026-6879",
      "title": "Quadratic Behavior in xml.etree.ElementPath Index Predicates",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-7774",
      "url": "https://patchblox.com/security/cve/CVE-2026-7774",
      "title": "tarfile.data_filter path traversal bypass allows writing outside the extraction directory",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-8328",
      "url": "https://patchblox.com/security/cve/CVE-2026-8328",
      "title": "FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    },
    {
      "cveId": "CVE-2026-87910",
      "url": "https://patchblox.com/security/cve/CVE-2026-87910",
      "title": "tarfile hardlink fallback ignores custom extraction filter rejection via None",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    }
  ],
  "dataAsOf": "2026-11-07T12:40:37Z"
}