Loading story…
CPython disclosed two medium-severity vulnerabilities affecting distinct parts of the runtime and tooling. CVE-2026-1502 allows CR/LF bytes to pass through HTTP client proxy tunnel header or host handling, creating a header-injection risk in proxy tunnel scenarios. The issue was published through Python security channels and the oss-sec mailing list, with remediation details tracked in the CVE record and an associated CPython pull request.
A second flaw, CVE-2026-5713, affects CPython remote debugging and introspection features and can trigger out-of-bounds read and write behavior when a privileged Python process connects to a malicious or compromised Python target. The bug impacts newer capabilities including profiling.sampling in Python 3.15+ and asyncio inspection commands such as ```
python -m asyncio ps
python -m asyncio pstree
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A medium-severity CPython vulnerability, CVE-2026-5713, was publicly disclosed affecting remote debugging-related functionality, where connecting from a privileged Python process to a malicious target could trigger out-of-bounds read and write access. The issue was reported as affecting newer features in Python 3.14+ and 3.15+, including asyncio introspection tools and profiling.sampling, with public references to the CVE record and a CPython GitHub pull request.
A medium-severity CPython vulnerability, CVE-2026-1502, was publicly disclosed involving improper validation of CR/LF bytes in HTTP client proxy tunnel headers or host values, creating a header-injection-style risk in proxy tunnel handling. The disclosure referenced the CVE record and an associated CPython pull request for affected versions and remediation details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
dCERT issued advisories for two Python-related vulnerabilities affecting **Red Hat Enterprise Linux** and **CPython**. One advisory warns that a flaw in `python-wheel` on Red Hat Enterprise Linux can allow **privilege escalation** and **arbitrary code execution**, creating a path for attackers to gain elevated access and run malicious code on affected systems. A second dCERT advisory reports a **CPython** vulnerability that can **bypass security measures**, indicating that protections relying on expected interpreter behavior may be undermined on vulnerable deployments. Together, the advisories highlight risk across both the Python runtime and packaging ecosystem, with potential impact ranging from weakened defensive controls to full code execution on enterprise Linux environments.
Jun 29, 2026
Python disclosed **CVE-2026-15308**, a high-severity denial-of-service flaw in `html.parser.HTMLParser` that can drive CPU exhaustion when applications incrementally parse untrusted HTML containing repeated unterminated markup declarations. The bug stems from quadratic-time behavior in `feed()`, where small repeated chunks force expensive rescanning and buffer concatenation across malformed tags, comments, doctypes, CDATA sections, processing instructions, and RAWTEXT elements. CPython maintainers shipped fixes and backports across supported branches including 3.10 through 3.15, with commits updating buffering logic to accumulate pending input more efficiently, defer reparsing until enough data arrives, adapt parsing thresholds based on parser progress, and flush buffered data on `close()`. The Python Software Foundation also updated the CVE record to clarify that affected versions are **earlier than 3.15.0**, not earlier than 3.16.0, while published metadata classifies the issue as **CWE-400** and notes no known exploitation at the time of disclosure.
Jul 10, 2026
Two high-severity vulnerabilities in the Python web UI framework **Mesop** exposed applications to unauthenticated compromise in version `1.2.2` and earlier. The most critical issue, tracked as `CVE-2026-33057`, allowed remote code execution through an exposed `/exec-py` route in Mesop's AI testing infrastructure, where a debugging Flask server accepted base64-encoded Python code and executed it without authentication. The flaw was assigned `CWE-94` and a `CVSS 3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. A second flaw, `CVE-2026-33054`, let attackers exploit path traversal via an untrusted `state_token` processed by `FileStateSessionBackend`, enabling file write or deletion outside intended application boundaries and potentially causing denial-of-service crash loops. That issue was classified as `CWE-22` with a `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`. Mesop addressed both vulnerabilities in version `1.2.3`, and GitHub published security advisories and patch references for the fixes.
Jun 29, 2026