Petr Viktorin

90 exploits Active since Jun 2024
CVE-2026-3276 WRITEUP MEDIUM WRITEUP
Python Software Foundation CPython - Potential DoS via Quadratic Complexity in unicodedata.normalize()
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
CVE-2026-11972 WRITEUP HIGH WRITEUP
Python Software Foundation CPython - Tarfile Opened in Streaming Mode Mishandles EOF
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
CVE-2026-4360 WRITEUP MEDIUM WRITEUP
Python Software Foundation CPython - Tarfile.extract() Doesn't Fully Respect Filter Parameter
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
CVSS 5.3
CVE-2026-6879 WRITEUP LOW WRITEUP
Python Software Foundation CPython - Quadratic Behavior in xml.etree.ElementPath Index Predicates
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
CVE-2026-6879 WRITEUP LOW WRITEUP
Python Software Foundation CPython - Quadratic Behavior in xml.etree.ElementPath Index Predicates
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
CVE-2026-6879 WRITEUP LOW WRITEUP
Python Software Foundation CPython - Quadratic Behavior in xml.etree.ElementPath Index Predicates
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
CVE-2026-6879 WRITEUP LOW WRITEUP
Python Software Foundation CPython - Quadratic Behavior in xml.etree.ElementPath Index Predicates
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
CVE-2026-6879 WRITEUP LOW WRITEUP
Python Software Foundation CPython - Quadratic Behavior in xml.etree.ElementPath Index Predicates
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match.
CVE-2026-4360 WRITEUP MEDIUM WRITEUP
Python Software Foundation CPython - Tarfile.extract() Doesn't Fully Respect Filter Parameter
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
CVSS 5.3
CVE-2026-7774 WRITEUP MEDIUM WRITEUP
tarfile.data_filter path traversal bypass allows writing outside the extraction directory
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
CVE-2026-4360 WRITEUP MEDIUM WRITEUP
Python Software Foundation CPython - Tarfile.extract() Doesn't Fully Respect Filter Parameter
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
CVSS 5.3
CVE-2026-11972 WRITEUP HIGH WRITEUP
Python Software Foundation CPython - Tarfile Opened in Streaming Mode Mishandles EOF
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
CVE-2026-11972 WRITEUP HIGH WRITEUP
Python Software Foundation CPython - Tarfile Opened in Streaming Mode Mishandles EOF
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
CVE-2026-11972 WRITEUP HIGH WRITEUP
Python Software Foundation CPython - Tarfile Opened in Streaming Mode Mishandles EOF
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
CVE-2026-4360 WRITEUP MEDIUM WRITEUP
Python Software Foundation CPython - Tarfile.extract() Doesn't Fully Respect Filter Parameter
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
CVSS 5.3
CVE-2026-11972 WRITEUP HIGH WRITEUP
Python Software Foundation CPython - Tarfile Opened in Streaming Mode Mishandles EOF
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
CVE-2026-4360 WRITEUP MEDIUM WRITEUP
Python Software Foundation CPython - Tarfile.extract() Doesn't Fully Respect Filter Parameter
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
CVSS 5.3
CVE-2026-11972 WRITEUP HIGH WRITEUP
Python Software Foundation CPython - Tarfile Opened in Streaming Mode Mishandles EOF
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
CVE-2026-4360 WRITEUP MEDIUM WRITEUP
Python Software Foundation CPython - Tarfile.extract() Doesn't Fully Respect Filter Parameter
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
CVSS 5.3
CVE-2026-11972 WRITEUP HIGH WRITEUP
Python Software Foundation CPython - Tarfile Opened in Streaming Mode Mishandles EOF
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
CVE-2026-4360 WRITEUP MEDIUM WRITEUP
Python Software Foundation CPython - Tarfile.extract() Doesn't Fully Respect Filter Parameter
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
CVSS 5.3
CVE-2026-7774 WRITEUP MEDIUM WRITEUP
tarfile.data_filter path traversal bypass allows writing outside the extraction directory
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
CVE-2026-7774 WRITEUP MEDIUM WRITEUP
tarfile.data_filter path traversal bypass allows writing outside the extraction directory
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
CVE-2026-7774 WRITEUP MEDIUM WRITEUP
tarfile.data_filter path traversal bypass allows writing outside the extraction directory
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
CVE-2026-7774 WRITEUP MEDIUM WRITEUP
tarfile.data_filter path traversal bypass allows writing outside the extraction directory
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.