Fixed in
Check your version
python3 -VCVEs affecting 3.11
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-4559 | Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Pyt... | 9.8 | — | 2007-08-28 | |
| CVE-2026-15308 | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | 8.7 | — | 2026-07-10 | |
| CVE-2022-45061 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when pr... | 7.5 | — | 2022-11-09 | |
| CVE-2023-24329 | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods... | 7.5 | — | 2023-02-17 | |
| CVE-2023-36632 | The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError... | 7.5 | — | 2023-06-25 | |
| CVE-2023-41105 | An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.no... | 7.5 | — | 2023-08-23 | |
| CVE-2024-7592 | Quadratic complexity parsing cookies with backslashes | 7.5 | — | 2024-08-20 | |
| CVE-2024-6232 | Regular-expression DoS when parsing TarFile headers | 7.5 | — | 2024-09-03 | |
| CVE-2022-26488 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately se... | 7.0 | — | 2022-03-08 | |
| CVE-2026-4519 | webbrowser.open() allows leading dashes in URLs | 7.0 | — | 2026-03-21 | |
| CVE-2021-28861 | Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection again... | 6.5 | — | 2022-08-23 | |
| CVE-2025-13836 | Excessive read buffering DoS in http.client | 6.3 | — | 2025-12-02 | |
| CVE-2025-12084 | Quadratic complexity in node ID cache clearing | 6.3 | — | 2025-12-04 | |
| CVE-2025-12781 | base64.b64decode() always accepts "+/" characters, despite setting altchars | 6.3 | — | 2026-01-22 | |
| CVE-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 6.3 | — | 2026-05-12 | |
| CVE-2020-10735 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using in... | 6.2 | — | 2022-09-09 | |
| CVE-2026-3644 | Incomplete control character validation in http.cookies | 6.0 | — | 2026-03-17 | |
| CVE-2026-3087 | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs | 6.0 | — | 2026-04-28 | |
| CVE-2023-27043 | The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character... | 5.3 | — | 2023-04-18 | |
| CVE-2023-40217 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before... | 5.3 | — | 2023-08-25 | |
| CVE-2024-9287 | Virtual environment (venv) activation scripts don't quote paths | 5.3 | — | 2024-10-23 | |
| CVE-2026-0864 | Configuration Injection via Carriage Return (\r) in write() method | 4.1 | — | 2026-06-24 | |
| CVE-2025-13837 | Out-of-memory when loading Plist | 2.1 | — | 2025-12-02 | |
| CVE-2026-6019 | BaseCookie.js_output() does not neutralize embedded characters | 2.1 | — | 2026-04-23 | |
| CVE-2025-13462 | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling | 2.0 | — | 2026-03-13 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).