Fixed in
Check your version
python3 -VCVEs affecting 3.8
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2022-37454 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer ove... | 9.8 | — | 2022-10-21 | |
| CVE-2019-10160 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f01... | 9.8 | — | 2019-06-08 | |
| CVE-2019-12900 | BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors... | 9.8 | — | 2019-06-20 | |
| CVE-2020-15801 | In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be load... | 9.8 | — | 2020-07-17 | |
| CVE-2020-27619 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retri... | 9.8 | — | 2020-10-22 | |
| CVE-2021-3177 | Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote... | 9.8 | — | 2021-01-19 | |
| CVE-2021-29921 | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP addres... | 9.8 | — | 2021-05-06 | |
| CVE-2022-48565 | An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accep... | 9.8 | — | 2023-08-22 | |
| CVE-2007-4559 | Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Pyt... | 9.8 | — | 2007-08-28 | |
| CVE-2026-15308 | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | 8.7 | — | 2026-07-10 | |
| CVE-2020-15523 | In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a T... | 7.8 | — | 2020-07-05 | |
| CVE-2015-20107 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discover... | 7.8 | — | 2022-04-13 | |
| CVE-2022-42919 | Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-defaul... | 7.8 | — | 2022-11-06 | |
| CVE-2019-17514 | library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about... | 7.5 | — | 2019-10-12 | |
| CVE-2022-0391 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resou... | 7.5 | — | 2022-02-09 | |
| CVE-2021-3737 | A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a... | 7.5 | — | 2022-03-04 | |
| CVE-2018-25032 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many dist... | 7.5 | — | 2022-03-25 | |
| CVE-2022-45061 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when pr... | 7.5 | — | 2022-11-09 | |
| CVE-2023-24329 | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods... | 7.5 | — | 2023-02-17 | |
| CVE-2023-36632 | The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError... | 7.5 | — | 2023-06-25 | |
| CVE-2022-48560 | A use-after-free exists in Python through 3.9 via heappushpop in heapq. | 7.5 | — | 2023-08-22 | |
| CVE-2024-7592 | Quadratic complexity parsing cookies with backslashes | 7.5 | — | 2024-08-20 | |
| CVE-2024-6232 | Regular-expression DoS when parsing TarFile headers | 7.5 | — | 2024-09-03 | |
| CVE-2020-26116 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allow... | 7.2 | — | 2020-09-27 | |
| CVE-2022-26488 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately se... | 7.0 | — | 2022-03-08 | |
| CVE-2026-4519 | webbrowser.open() allows leading dashes in URLs | 7.0 | — | 2026-03-21 | |
| CVE-2013-0340 | expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses th... | 6.8 | — | 2014-01-22 | |
| CVE-2016-3189 | Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of servi... | 6.5 | — | 2016-07-01 | |
| CVE-2020-8492 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 all... | 6.5 | — | 2020-01-30 | |
| CVE-2021-3733 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server th... | 6.5 | — | 2022-03-07 | |
| CVE-2021-28861 | Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection again... | 6.5 | — | 2022-08-23 | |
| CVE-2022-48564 | read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhau... | 6.5 | — | 2023-08-22 | |
| CVE-2025-13836 | Excessive read buffering DoS in http.client | 6.3 | — | 2025-12-02 | |
| CVE-2025-12084 | Quadratic complexity in node ID cache clearing | 6.3 | — | 2025-12-04 | |
| CVE-2025-12781 | base64.b64decode() always accepts "+/" characters, despite setting altchars | 6.3 | — | 2026-01-22 | |
| CVE-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 6.3 | — | 2026-05-12 | |
| CVE-2020-10735 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using in... | 6.2 | — | 2022-09-09 | |
| CVE-2026-3644 | Incomplete control character validation in http.cookies | 6.0 | — | 2026-03-17 | |
| CVE-2026-4224 | Stack overflow parsing XML with deeply nested DTD content models | 6.0 | — | 2026-03-17 | |
| CVE-2026-3087 | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs | 6.0 | — | 2026-04-28 | |
| CVE-2020-14422 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interfac... | 5.9 | — | 2020-06-18 | |
| CVE-2021-23336 | Web Cache Poisoning | 5.9 | — | 2021-02-15 | |
| CVE-2022-48566 | An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating opti... | 5.9 | — | 2023-08-22 | |
| CVE-2021-3426 | There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another... | 5.7 | — | 2021-05-20 | |
| CVE-2020-8315 | In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load... | 5.5 | — | 2020-01-29 | |
| CVE-2019-20907 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite l... | 5.5 | — | 2020-07-13 | |
| CVE-2019-18348 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF i... | 5.4 | — | 2019-10-24 | |
| CVE-2021-4189 | A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive)... | 5.3 | — | 2022-08-24 | |
| CVE-2023-27043 | The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character... | 5.3 | — | 2023-04-18 | |
| CVE-2023-40217 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before... | 5.3 | — | 2023-08-25 | |
| CVE-2024-9287 | Virtual environment (venv) activation scripts don't quote paths | 5.3 | — | 2024-10-23 | |
| CVE-2026-0864 | Configuration Injection via Carriage Return (\r) in write() method | 4.1 | — | 2026-06-24 | |
| CVE-2025-13837 | Out-of-memory when loading Plist | 2.1 | — | 2025-12-02 | |
| CVE-2026-6019 | BaseCookie.js_output() does not neutralize embedded characters | 2.1 | — | 2026-04-23 | |
| CVE-2025-13462 | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling | 2.0 | — | 2026-03-13 | |
| CVE-2025-6075 | Quadratic complexity in os.path.expandvars() with user-controlled template | 1.8 | — | 2025-11-01 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).