{
  "product": "Python 3.9",
  "url": "https://patchblox.com/security/product/windows-app/python-3.9",
  "summary": "The latest version of Python 3.9 is 3.9.13, released May 17, 2022. Patch Radar has 2 security fixes for Python 3.9, closing 4 CVEs. The newest security fix is Python 3.9 3.9.13, released May 17, 2022. 85 CVEs have no fix yet.",
  "platform": "windows-app",
  "vendor": "Python Software Foundation",
  "supported": true,
  "latestVersion": "3.9.13",
  "latestReleased": "2022-05-17T00:00:00Z",
  "fixCount": 2,
  "cveCount": 4,
  "exploitedCveCount": 0,
  "unfixedCveCount": 85,
  "fixes": [
    {
      "fix": "Python 3.9 3.9.13",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.9-3.9.13",
      "released": "2022-05-17T00:00:00Z",
      "fixedVersion": "3.9.13",
      "priority": "High",
      "cveCount": 3,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.9 3.9.7",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.9-3.9.7",
      "released": "2021-08-30T00:00:00Z",
      "fixedVersion": "3.9.7",
      "priority": "Routine",
      "cveCount": 1,
      "exploitedCveCount": 0
    }
  ],
  "noFixYet": [
    {
      "cveId": "CVE-2026-115557",
      "url": "https://patchblox.com/security/cve/CVE-2026-115557",
      "title": "Distrust compromised intermediate certificates in ssl module",
      "priority": "Urgent",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-19445",
      "url": "https://patchblox.com/security/cve/CVE-2026-19445",
      "title": "Use-after-free of a server-side SSLContext when sni_callback switches contexts",
      "priority": "Urgent",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2007-4559",
      "url": "https://patchblox.com/security/cve/CVE-2007-4559",
      "title": "Python 3.10 and 8 others: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2015-20107",
      "url": "https://patchblox.com/security/cve/CVE-2015-20107",
      "title": "Python 3.8 and 4 others: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2020-10735",
      "url": "https://patchblox.com/security/cve/CVE-2020-10735",
      "title": "Python 3.8 and 5 others: Incorrect Type Conversion or Cast",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2021-28861",
      "url": "https://patchblox.com/security/cve/CVE-2021-28861",
      "title": "Python 3.8 and 7 others: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2022-26488",
      "url": "https://patchblox.com/security/cve/CVE-2022-26488",
      "title": "Python 3.8 and 8 others: In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2022-37454",
      "url": "https://patchblox.com/security/cve/CVE-2022-37454",
      "title": "Python 3.8 and 5 others: Integer Overflow or Wraparound",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2022-42919",
      "url": "https://patchblox.com/security/cve/CVE-2022-42919",
      "title": "Python 3.10 and 4 others: Deserialization of Untrusted Data",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2023-24329",
      "url": "https://patchblox.com/security/cve/CVE-2023-24329",
      "title": "Python 3.10 and 8 others: Improper Input Validation",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2023-36632",
      "url": "https://patchblox.com/security/cve/CVE-2023-36632",
      "title": "Python 3.10 and 8 others: The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \u0022RecursionError:\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2023-40217",
      "url": "https://patchblox.com/security/cve/CVE-2023-40217",
      "title": "Python 3.10 and 8 others: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2023-6597",
      "url": "https://patchblox.com/security/cve/CVE-2023-6597",
      "title": "Python 3.10 and 9 others: An issue was found in the CPython \u0060tempfile.TemporaryDirectory\u0060 class affecting versions 3.12.1, 3.11.7,\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-0397",
      "url": "https://patchblox.com/security/cve/CVE-2024-0397",
      "title": "Memory race condition in ssl.SSLContext certificate store methods",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-11168",
      "url": "https://patchblox.com/security/cve/CVE-2024-11168",
      "title": "Improper validation of IPv6 and IPvFuture addresses",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-12254",
      "url": "https://patchblox.com/security/cve/CVE-2024-12254",
      "title": "Unbounded memory buffering in SelectorSocketTransport.writelines()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-12718",
      "url": "https://patchblox.com/security/cve/CVE-2024-12718",
      "title": "Bypass extraction filter to modify file metadata outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-4030",
      "url": "https://patchblox.com/security/cve/CVE-2024-4030",
      "title": "tempfile.mkdtemp() may be readable and writeable by all users on Windows",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-4032",
      "url": "https://patchblox.com/security/cve/CVE-2024-4032",
      "title": "Incorrect IPv4 and IPv6 private ranges",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-5642",
      "url": "https://patchblox.com/security/cve/CVE-2024-5642",
      "title": "Buffer overread when using an empty list with SSLContext.set_npn_protocols()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-6232",
      "url": "https://patchblox.com/security/cve/CVE-2024-6232",
      "title": "Regular-expression DoS when parsing TarFile headers",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-6923",
      "url": "https://patchblox.com/security/cve/CVE-2024-6923",
      "title": "Email header injection due to unquoted newlines",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-7592",
      "url": "https://patchblox.com/security/cve/CVE-2024-7592",
      "title": "Quadratic complexity parsing cookies with backslashes",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-8088",
      "url": "https://patchblox.com/security/cve/CVE-2024-8088",
      "title": "Infinite loop when iterating over zip archive entry names from zipfile.Path",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-9287",
      "url": "https://patchblox.com/security/cve/CVE-2024-9287",
      "title": "Virtual environment (venv) activation scripts don\u0027t quote paths",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-0938",
      "url": "https://patchblox.com/security/cve/CVE-2025-0938",
      "title": "URL parser allowed square brackets in domain names",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-12084",
      "url": "https://patchblox.com/security/cve/CVE-2025-12084",
      "title": "Quadratic complexity in node ID cache clearing",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-13836",
      "url": "https://patchblox.com/security/cve/CVE-2025-13836",
      "title": "Excessive read buffering DoS in http.client",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-13837",
      "url": "https://patchblox.com/security/cve/CVE-2025-13837",
      "title": "Out-of-memory when loading Plist",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-15282",
      "url": "https://patchblox.com/security/cve/CVE-2025-15282",
      "title": "Header injection via newlines in data URL mediatype",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-15366",
      "url": "https://patchblox.com/security/cve/CVE-2025-15366",
      "title": "IMAP command injection in user-controlled commands",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-15367",
      "url": "https://patchblox.com/security/cve/CVE-2025-15367",
      "title": "POP3 command injection in user-controlled commands",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-4138",
      "url": "https://patchblox.com/security/cve/CVE-2025-4138",
      "title": "Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-4330",
      "url": "https://patchblox.com/security/cve/CVE-2025-4330",
      "title": "Extraction filter bypass for linking outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-4435",
      "url": "https://patchblox.com/security/cve/CVE-2025-4435",
      "title": "Tarfile extracts filtered members when errorlevel=0",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-4516",
      "url": "https://patchblox.com/security/cve/CVE-2025-4516",
      "title": "Use-after-free in \u0022unicode_escape\u0022 decoder with error handler",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-4517",
      "url": "https://patchblox.com/security/cve/CVE-2025-4517",
      "title": "Arbitrary writes via tarfile realpath overflow",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-8194",
      "url": "https://patchblox.com/security/cve/CVE-2025-8194",
      "title": "Tarfile infinite loop during parsing with negative member offset",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-8291",
      "url": "https://patchblox.com/security/cve/CVE-2025-8291",
      "title": "ZIP64 End of Central Directory (EOCD) Locator record offset not checked",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-0672",
      "url": "https://patchblox.com/security/cve/CVE-2026-0672",
      "title": "Header injection in http.cookies.Morsel",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-0865",
      "url": "https://patchblox.com/security/cve/CVE-2026-0865",
      "title": "wsgiref.headers.Headers allows header newline injection",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-11940",
      "url": "https://patchblox.com/security/cve/CVE-2026-11940",
      "title": "tarfile extraction filter bypass allows escaping the destination directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-11972",
      "url": "https://patchblox.com/security/cve/CVE-2026-11972",
      "title": "tarfile opened in streaming mode mishandles EOF",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-12345",
      "url": "https://patchblox.com/security/cve/CVE-2026-12345",
      "title": "Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-1299",
      "url": "https://patchblox.com/security/cve/CVE-2026-1299",
      "title": "email BytesGenerator header injection due to unquoted newlines",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-1502",
      "url": "https://patchblox.com/security/cve/CVE-2026-1502",
      "title": "HTTP client proxy tunnel headers not validated for CR/LF",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-15308",
      "url": "https://patchblox.com/security/cve/CVE-2026-15308",
      "title": "Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-19553",
      "url": "https://patchblox.com/security/cve/CVE-2026-19553",
      "title": "SSLContext.wrap_bio() missing validation of server_hostname parameter",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-2297",
      "url": "https://patchblox.com/security/cve/CVE-2026-2297",
      "title": "SourcelessFileLoader does not use io.open_code()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-3298",
      "url": "https://patchblox.com/security/cve/CVE-2026-3298",
      "title": "Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-3644",
      "url": "https://patchblox.com/security/cve/CVE-2026-3644",
      "title": "Incomplete control character validation in http.cookies",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-4224",
      "url": "https://patchblox.com/security/cve/CVE-2026-4224",
      "title": "Stack overflow parsing XML with deeply nested DTD content models",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-4519",
      "url": "https://patchblox.com/security/cve/CVE-2026-4519",
      "title": "webbrowser.open() allows leading dashes in URLs",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-4786",
      "url": "https://patchblox.com/security/cve/CVE-2026-4786",
      "title": "Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-6019",
      "url": "https://patchblox.com/security/cve/CVE-2026-6019",
      "title": "BaseCookie.js_output() does not neutralize embedded characters",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-6100",
      "url": "https://patchblox.com/security/cve/CVE-2026-6100",
      "title": "Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-7210",
      "url": "https://patchblox.com/security/cve/CVE-2026-7210",
      "title": "The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-82049",
      "url": "https://patchblox.com/security/cve/CVE-2026-82049",
      "title": "tarfile extraction filters allow file modification and content disclosure via hard link to symlink",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-9669",
      "url": "https://patchblox.com/security/cve/CVE-2026-9669",
      "title": "bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2023-27043",
      "url": "https://patchblox.com/security/cve/CVE-2023-27043",
      "title": "Python 3.10 and 8 others: Improper Input Validation",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-0450",
      "url": "https://patchblox.com/security/cve/CVE-2024-0450",
      "title": "Quoted zip-bomb protection for zipfile",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-3219",
      "url": "https://patchblox.com/security/cve/CVE-2024-3219",
      "title": "Pure-Python fallback of socket.socketpair() doesn\u2019t authenticate peer connection",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2024-3220",
      "url": "https://patchblox.com/security/cve/CVE-2024-3220",
      "title": "Default mimetype known files writeable on Windows",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-11468",
      "url": "https://patchblox.com/security/cve/CVE-2025-11468",
      "title": "Folding email comments of unfoldable characters doesn\u0027t preserve parenthesis",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-12781",
      "url": "https://patchblox.com/security/cve/CVE-2025-12781",
      "title": "base64.b64decode() always accepts \u0022\u002B/\u0022 characters, despite setting altchars",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-13462",
      "url": "https://patchblox.com/security/cve/CVE-2025-13462",
      "title": "tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2025-1795",
      "url": "https://patchblox.com/security/cve/CVE-2025-1795",
      "title": "Mishandling of comma during folding and unicode-encoding of email headers",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-0864",
      "url": "https://patchblox.com/security/cve/CVE-2026-0864",
      "title": "Configuration Injection via Carriage Return (\\r) in write() method",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-103995",
      "url": "https://patchblox.com/security/cve/CVE-2026-103995",
      "title": "Lenient parsing of integers for response body and chunk framing",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-114583",
      "url": "https://patchblox.com/security/cve/CVE-2026-114583",
      "title": "tar filter allows writing outside destination via empty-named symlink",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-116566",
      "url": "https://patchblox.com/security/cve/CVE-2026-116566",
      "title": "socket.getaddrinfo() accepts embedded null bytes in host and port",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-12003",
      "url": "https://patchblox.com/security/cve/CVE-2026-12003",
      "title": "CPython \u003E3.11 Insecure Input Validation resulting in privilege escalation",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-15310",
      "url": "https://patchblox.com/security/cve/CVE-2026-15310",
      "title": "zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-15806",
      "url": "https://patchblox.com/security/cve/CVE-2026-15806",
      "title": "\u0060HTTPPasswordMgr\u0060 can send saved HTTPS credentials via HTTP because of incorrect scheme matching",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-17084",
      "url": "https://patchblox.com/security/cve/CVE-2026-17084",
      "title": "stringprep.map_table_b2() deviates from RFC 3454 Table B.2",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-18503",
      "url": "https://patchblox.com/security/cve/CVE-2026-18503",
      "title": "Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-19672",
      "url": "https://patchblox.com/security/cve/CVE-2026-19672",
      "title": "tarfile extraction filter bypass allows creation of directories outside the destination",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-3087",
      "url": "https://patchblox.com/security/cve/CVE-2026-3087",
      "title": "shutil.unpack_archive() doesn\u0027t check for Windows absolute paths in ZIPs",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-3276",
      "url": "https://patchblox.com/security/cve/CVE-2026-3276",
      "title": "Potential DoS via quadratic complexity in unicodedata.normalize()",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-3446",
      "url": "https://patchblox.com/security/cve/CVE-2026-3446",
      "title": "Base64 decoding stops at first padded quad by default",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-3479",
      "url": "https://patchblox.com/security/cve/CVE-2026-3479",
      "title": "pkgutil.get_data() does not enforce documented restrictions",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-6879",
      "url": "https://patchblox.com/security/cve/CVE-2026-6879",
      "title": "Quadratic Behavior in xml.etree.ElementPath Index Predicates",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-7774",
      "url": "https://patchblox.com/security/cve/CVE-2026-7774",
      "title": "tarfile.data_filter path traversal bypass allows writing outside the extraction directory",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-8328",
      "url": "https://patchblox.com/security/cve/CVE-2026-8328",
      "title": "FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    },
    {
      "cveId": "CVE-2026-87910",
      "url": "https://patchblox.com/security/cve/CVE-2026-87910",
      "title": "tarfile hardlink fallback ignores custom extraction filter rejection via None",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.9.13"
    }
  ],
  "dataAsOf": "2026-11-07T12:40:37Z"
}