SUSE-SU-2026:0642-1: python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise
Published
Published 26-02-2026Last modified 26-02-2026
Vulnerability summary
SUSE-SU-2026:0642-1 is a vulnerability in python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 5 · Downstream 0 · Related 5Timeline
- 26-02-2026PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
Security update for python313 This update for python313 fixes the following issues: Update to Python 3.13.12 - CVE-2026-0672: Fixed a HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel. (bsc#1257031) - CVE-2026-0865: Fixed a bug where a user-controlled header containing newlines can allow injecting HTTP headers. (bsc#1257042) - CVE-2025-15282: Fixed a bug where a user-controlled data URLs parsed may allow injecting headers. (bsc#1257046) - CVE-2025-11468: Fixed a header injection when folding a long comment in an email header containing exclusively unfoldable characters. (bsc#1257029) - CVE-2026-1299: Fixed header injection when an email is serialized due to improper newline quoting in `BytesGenerator`: Fixed a header injection when folding a long comment in an email header containing exclusively unfoldable characters. (bsc#1257029)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse2 products
- python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7< 3.13.12-150700.4.39.1
- python313&distro=SUSE Linux Enterprise Module for Python 3 15 SP7< 3.13.12-150700.4.39.1
1 vendor · 2 products
References
11 linksShow all 11 references
Related vulnerabilities
Insufficient evidenceSUSE-SU-2026:4941-1SUSE Linux Enterprisesuse · python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7 +1 moresuse python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7Security update for python313
This update for python313 fixes the following issues:
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free
(bsc#1283969).
- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses
(bsc#1283826).
- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).
- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file
modification and content disclosure (bsc#1280459).
Changes for python313:
- Updated to version 3.13.16.CVSSUnscoredInsufficient evidenceSUSE-SU-2026:4401-1SUSE Linux Enterprisesuse · python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7 +1 moresuse python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7Security update for python313
This update for python313 fixes the following issues:
Security issues fixed:
- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high
CPU usage (bsc#1273148).
- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-17084: [Security-announce][] StringPrep algorithm considered (bsc#1276226).
- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect
sniffing and consume significant CPU (bsc#1274683).
Non security issue fixed:
- Conflicts between different versions of Python (bsc#1258364).
- Updated to version 3.13.15CVSSUnscoredInsufficient evidenceSUSE-SU-2026:3649-1SUSE Linux Enterprisesuse · python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7 +1 moresuse python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7Security update for python313
This update for python313 fixes the following issues:
- CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
- CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
`configparser` module is used (bsc#1269066).
- CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262429).
- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted
Unicode input (bsc#1267581).
- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting
hardlinks (bsc#1269959).
- CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules
(bsc#1262098).
- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding
protection (bsc#1264962).
- CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory
(bsc#1267821).
- CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and
enables arbitrary file reads and writes (bsc#1268977).
- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS
(bsc#1269788).
- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations
(bsc#1271192).
- Regression in `http.cookies` (bsc#1263083).
Changes for python313:
- Update to 3.13.14:
- Security
- gh-151159: Bumps the OpenSSL version to 3.0.21 on Android.
- gh-150599: Fix a possible stack buffer overflow in bz2 when
a bz2.BZ2Decompressor is reused after a decompression
error. The decompressor now becomes unusable after libbz2
reports an error.
- gh-149835: shutil.move() now resolves symlinks via
os.path.realpath() when checking whether the destination is
inside the source directory, preventing a symlink-based
bypass of that guard.
- gh-149698: Update bundled libexpat to version 2.8.1 for the
fix for CVE 2026-45186.
- gh-87451: The ftplib module's undocumented ftpcp function
no longer trusts the IPv4 address value returned from the
source server in response to the PASV command by default,
completing the fix for CVE-2021-4189. As with ftplib.FTP,
the former behavior can be re-enabled by setting the
trust_server_pasv_ipv4_address attribute on the source
ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
AI for the report (bsc#1265268, CVE-2026-8328)
- gh-149486: tarfile.data_filter() now validates link targets
using the same normalised value that is written to disk,
strips trailing separators from the member name when
resolving a symlink's directory, and rejects link members
that would replace the destination directory itself. This
closes several path-traversal bypasses of the data
extraction filter (bsc#1267821, CVE-2026-7774).
- gh-149079: Fix a potential denial of service in
unicodedata.normalize(). The canonical ordering step of
Unicode normalization used a quadratic-time insertion sort
for reordering combining characters, which could be
exploited with crafted input containing many combining
characters in non-canonical order. Replaced with
a linear-time counting sort for long runs (bsc#1267581,
CVE-2026-3276).
- gh-149018: Improved protection against XML hash-flooding
attacks in xml.parsers.expat and xml.etree.ElementTree when
Python is compiled with libExpat 2.8.0 or later
(CVE-2026-7210, bsc#1264962).
- gh-149017: Update bundled libexpat to version 2.8.0.
- gh-90309: Base64-encode values when embedding cookies to
JavaScript using the http.cookies.BaseCookie.js_output()
method to avoid injection and escaping. (bsc#1262654,
CVE-2026-6019)
- gh-148808: Added buffer boundary check when using nbytes
parameter with
asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
relevant for Windows and the asyncio.ProactorEventLoop.
- gh-148395: Fix a dangling input pointer in
lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
zlib._ZlibDecompressor when memory allocation fails with
MemoryError, which could let a subsequent decompress() call
read or write through a stale pointer to the
already-released caller buffer. (bsc#1262098,
CVE-2026-6100, seems like it has been incompletely applied
gh#python/cpython#151605)
- gh-148169: A bypass in webbrowser allowed URLs prefixed
with %action to pass the dash-prefix safety check
(bsc#1262098, CVE-2026-6100).
- gh-146581: Fix vulnerability in shutil.unpack_archive() for
ZIP files on Windows which allowed to write files outside
of the destination tree if the patch in the archive
contains a Windows drive prefix. Now such invalid paths
will be skipped. Files containing '..' in the name (like
'foo..bar') are no longer skipped.
- gh-146333: Fix quadratic backtracking in
configparser.RawConfigParser option parsing regexes (OPTCRE
and OPTCRE_NV). A crafted configuration line with many
whitespace characters could cause excessive CPU usage.
- gh-146211: Reject CR/LF characters in tunnel request
headers for the HTTPConnection.set_tunnel() method.
(bsc#1261969, CVE-2026-1502)
- gh-149144: Fixes an issue introduced by CVE-2026-6019
patch. atob() in JavaScript processes bytes as 'latin-1',
switches the encoding algorithm from base64 to percent
encoding and uses the decodeURIComponent() JavaScript API
(bsc#1263083).
- Core and Builtins
- gh-151112: Fix a crash in the compiler that could occur
when running out of memory.
- gh-151126: Fix a crash, when there's no memory left on
a device, which happened in:
- code compilation - _winapi.CreateProcess()
- Now these places raise proper MemoryError errors.
- gh-150633: Fix the frozen importer accepting module names
with embedded null bytes, which caused it to bypass the
sys.modules cache and create duplicate module objects.
- gh-149156: Fix an intermittent crash after os.fork() when
perf trampoline profiling is enabled and the child returns
through trampoline frames inherited from the parent
process.
- gh-149449: Fix a use-after-free crash when the unicodedata
module was removed from sys.modules and garbage-collected
between calls that decode \N{...} escapes or use the
namereplace codec error handler.
- gh-148450: Fix abc.register() so it invalidates type
version tags for registered classes.
- gh-150207: Fix a crash when a memory allocation fails
during tokenizer initialization. A proper MemoryError is
now raised instead.
- gh-150107: asyncio: sendfile() and sock_sendfile() event
loop methods now call file.seek(offset) if file has
a seek() method, even if offset is 0 (default value).
- gh-150146: Fix a crash on a complex type variable
substitution.
- from typing import TypeVar;
memoryview[TypeVar('')][*typing.Mapping[..., ...]] used to
fail due to missing NULL check on _unpack_args C function
call.
- gh-149590: Fix crash when faulthandler is imported more
than once.
- gh-149738: sqlite3: Disallow removing row_factory and
text_factory attributes of a connection to prevent a crash
on a query.
- gh-139808: Add branch protections for AArch64 (BTI/PAC) in
assembly code used by -X perf_jit (Linux perf profiler
integration).
- gh-148820: Fix a race in _PyRawMutex on the free-threaded
build where a Py_PARK_INTR return from _PySemaphore_Wait
could let the waiter destroy its semaphore before the
unlocking thread's _PySemaphore_Wakeup completed, causing
a fatal ReleaseSemaphore error.
- gh-148653: Forbid marshalling recursive code objects which
cannot be correctly unmarshalled.
- gh-148390: Fix an undefined behavior in memoryview when
using the native boolean format (?) in cast(). Previously,
on some common platforms, calling
memoryview(b).cast('?').tolist() incorrectly returned
[False] instead of [True] for any even byte b. Patch by
Bénédikt Tran.
- gh-148418: Fix a possible reference leak in a corrupted
TYPE_CODE marshal stream.
- gh-148222: Fix vectorcall support in types.GenericAlias
when the underlying type does not support the vectorcall
protocol. Fix possible leaks in types.GenericAlias and
types.UnionType in case of memory error.
- gh-145376: Fix reference leaks in various unusual error
scenarios.
- C API
- gh-150907: Fix dynamic_annotations.h header file when built
with C++ and Valgrind: add extern 'C++' scope for the C++
template. Patch by Victor Stinner.
- Build
- gh-149351: Avoid possible broken macOS framework install
names when DESTDIR is specified during builds.
- gh-146475: Block Apple Clang from being used to build the
JIT as it ships without required LLVM tools.
- gh-148535: No longer use the gcc -fprofile-update=atomic
flag on i686. The flag has been added to fix a random GCC
internal error on PGO build (gh-145801) caused by
corruption of profile data (.gcda files). The problem is
that it makes the PGO build way slower (up to 47x slower)
on i686. Since the GCC internal error was not seen on i686
so far, don't use -fprofile-update=atomic on i686 anymore.
Patch by Victor Stinner.
- Library
- gh-150913: Fix sqlite3.Blob slice assignment to raise
TypeError and IndexError for type and size mismatches
respectively, even when the target slice is empty.
- gh-143008: Fix race conditions when re-initializing
a io.TextIOWrapper object.
- gh-150685: Update bundled pip to 26.1.2
- gh-150406: Fix a possible crash occurring during socket
module initialization when the system is out of memory on
platforms without a reentrant gethostbyname.
- gh-150372: readline: Fix a potential crash during tab
completion caused by an out-of-memory error during module
initialization.
- gh-150175: Fix race condition in
unittest.mock.ThreadingMock where concurrent calls could
lose increments to call_count and other attributes due to
a missing lock in _increment_mock_call.
- gh-84353: Preserve non-UTF-8 encoded filenames when
appending to a zipfile.ZipFile. Previously, non-ASCII names
stored in a legacy encoding (without the UTF-8 flag bit
set) could be corrupted when the central directory was
rewritten: they were decoded as cp437 and then re-stored as
UTF-8.
- gh-149995: Update various docstrings in typing.
- gh-88726: The email package now uses standard MIME charset
names 'gb2312' and 'big5' instead of non-standard names
'eucgb2312_cn' and 'big5_tw'.
- gh-149571: Fix the C implementation of
xml.etree.ElementTree.Element.itertext(): it no longer
emits text for comments and processing instructions.
- gh-149921: Fix reference leaks in error paths of the
_interpchannels and _interpqueues extension modules.
- gh-149801: Add IANA registered names and aliases with
leading zeros before number (like IBM00858, CP00858,
IBM01140, CP01140) for corresponding codecs.
- gh-149701: Fix bad return code from Lib/venv/bin/activate
if hashing is disabled
- gh-112821: In the REPL, autocompletion might run arbitrary
code in the getter of a descriptor. If that getter raised
an exception, autocompletion would fail to present any
options for the entire object. Autocompletion now works as
expected for these objects.
- gh-149388: Make asyncio.windows_utils.PipeHandle closing
idempotent.
- gh-149489: Fix ElementTree serialization to HTML. The
content of elements 'xmp', 'iframe', 'noembed', 'noframes',
and 'plaintext' is no longer escaped. The 'plaintext'
element no longer have the closing tag.
- gh-149377: Update bundled pip to 26.1.1
- gh-149231: In tomllib, the number of parts in TOML keys is
now limited.
- gh-149117: Fix runpy.run_module() and runpy.run_path() to
set the name attribute on the ImportError they raise.
- gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
version fixes the CVE 2026-3219 vulnerability. Patch by
Victor Stinner.
- gh-148093: Fix an out-of-bounds read of one byte in
binascii.a2b_uu(). Raise binascii.Error, instead of reading
past the buffer end.
- gh-148914: Fix memoization of in-band PickleBuffer in the
Python implementation of pickle. Previously, identical
PickleBuffers did not preserve identity, and empty writable
PickleBuffer memoized an empty bytearray object in place of
b'', so the following references to b'' were unpickled as
an empty bytearray object.
- gh-138907: Support RFC 9309 in urllib.robotparser.
- gh-148954: Fix XML injection vulnerability in
xmlrpc.client.dumps() where the methodname was not being
escaped before interpolation into the XML body.
- gh-148801: xml.etree.ElementTree: Fix a crash in
Element.__deepcopy__ on deeply nested trees.
- gh-148735: xml.etree.ElementTree: Fix a use-after-free in
Element.findtext when the element tree is mutated
concurrently during the search.
- gh-146553: Fix infinite loop in typing.get_type_hints()
when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
- gh-148508: An intermittent timing error when running SSL
tests on iOS has been resolved.
- gh-148518: If an email containing an address header that
ended in an open double quote was parsed with
a non-compat32 policy, accessing the username attribute of
the mailbox accessed through that header object would
result in an IndexError. It now correctly returns an empty
string as the result.
- gh-148370: configparser: prevent quadratic behavior when
a ParsingError is raised after a parser fails to parse
multiple lines. Patch by Bénédikt Tran.
- gh-148254: Use singular 'sec' instead of 'secs' in timeit
verbose output for consistency with other time units.
- gh-148192: email.generator.Generator._make_boundary could
fail to detect a duplicate boundary string if linesep was
not n. It now correctly detects boundary strings when
linesep is rn as well.
- gh-146313: Fix a deadlock in multiprocessing's resource
tracker where the parent process could hang indefinitely in
os.waitpid() during interpreter shutdown if a child created
via os.fork() still held the resource tracker's pipe open.
- gh-145831: Fix email.quoprimime.decode() leaving a stray \r
when eol='\r\n' by stripping the full eol string instead of
one character.
- gh-145105: Fix crash in csv reader when iterating with
a re-entrant iterator that calls next() on the same reader
from within __next__.
- gh-130750: Restore quoting of choices in argparse error
messages for improved clarity and consistency with
documentation.
- gh-105936: Attempting to mutate non-field attributes of
dataclasses with both frozen and slots being True now
raises FrozenInstanceError instead of TypeError. Their
non-dataclass subclasses can now freely mutate non-field
attributes, and the original non-slotted class can be
garbage collected. The fix also handles the case of an
empty __class__ cell on a function found within the class
(gh-148947).
- gh-142516: ssl: fix reference leaks in ssl.SSLContext
objects. Patch by Bénédikt Tran.
- gh-142831: Fix a crash in the json module where
a use-after-free could occur if the object being encoded is
modified during serialization.
- gh-140287: The asyncio REPL now handles exceptions when
executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
- gh-90949: Add
SetBillionLaughsAttackProtectionActivationThreshold() and
SetBillionLaughsAttackProtectionMaximumAmplification() to
xmlparser objects to tune protections against billion
laughs attacks. Patch by Bénédikt Tran.
- gh-132631: Fix 'I/O operation on closed file' when parsing
JSON Lines file with JSON CLI.
- gh-128110: Fix bug in the parsing of email address headers
that could result in extraneous spaces in the decoded text
when using a modern email policy. Space between pairs of
adjacent RFC 2047 encoded-words is now ignored, per section
6.2 (and consistent with existing parsing of unstructured
headers like Subject).
- gh-107398: Fix tarfile stream mode exception when process
the file with the gzip extra field.
- gh-123853: Update the table of Windows language code
identifiers (LCIDs) used by locale.getdefaultlocale() on
Windows to protocol version 16.0 (2024-04-23).
- gh-70039: Fixed bug where smtplib.SMTP.starttls() could
fail if smtplib.SMTP.connect() is called explicitly rather
than implicitly.
- gh-83281: email: improve handling trailing garbage in
address lists to avoid throwing AttributeError in certain
edge cases
- gh-91099: imaplib.IMAP4.login() now raises exceptions with
str instead of bytes. Patch by Florian Best.
- IDLE
- bpo-6699: Warn the user if a file will be overwritten when
saving.
- Documentation
- gh-150319: Generic builtin and standard library types now
document the meaning of their type parameters.
- gh-148663: Document that calendar.IllegalMonthError is
a subclass of both ValueError and IndexError since Python
3.12.
- gh-146646: Document that glob.glob(), glob.iglob(),
pathlib.Path.glob(), and pathlib.Path.rglob() silently
suppress OSError exceptions raised from scanning the
filesystem.
- gh-109503: Fix documentation for shutil.move() on usage of
os.rename() since nonatomic move might be used even if the
files are on the same filesystem. Patch by Fang Li
- Tests
- gh-151130: Add more tests for PyWeakref_* C API.
- gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
skip UDP Lite tests if it's not supported. Patch by Victor
Stinner.CVSSUnscoredInsufficient evidenceSUSE-SU-2026:2464-1SUSE Linux Enterprisesuse · python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7 +1 moresuse python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7Security update for python313
This update for python313 fixes the following issues
Security issues:
- CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
- CVE-2026-4786: [oss-security][] CPython: Incomplete mitigation of , %action expansion for command injection to
webbrowser.open() (bsc#1262319).
- CVE-2026-6019: `BaseCookie.js_output()` does not neutralize characters in cookie values embedded in JS (bsc#1262654).
- CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules
(bsc#1262098).
Non security issue:
- Add missing BR `crypto-policies-scripts` (need for the fix of bsc#1211301).CVSSUnscoredInsufficient evidenceSUSE-SU-2026:1354-1SUSE Linux Enterprisesuse · python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7 +1 moresuse python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7Security update for python313
This update for python313 fixes the following issues:
- Update to v3.13.13
- CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
- CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).
- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
- CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
- CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web browser command line option injection (bsc#1260026).CVSSUnscoredInsufficient evidenceSUSE-SU-2026:0024-1SUSE Linux Enterprisesuse · python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7 +1 moresuse python313-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP7Security update for python313
This update for python313 fixes the following issues:
Update to version 3.13.11.
Security issues fixed:
- CVE-2025-12084: quadratic complexity when building nested elements using `xml.dom.minidom` methods that depend on
`_clear_id_cache()` can lead to availability issues when building excessively nested documents (bsc#1254997).
- CVE-2025-13836: use of `Content-Length` by default when reading an HTTP response with no read amount specified can
lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
- CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can lead to OOM
issues and DoS (bsc#1254401).
Other updates and bugfixes:
- Version 3.13.11:
* Library
- gh-140797: Revert changes to the undocumented re.Scanner
class. Capturing groups are still allowed for backward
compatibility, although using them can lead to incorrect
result. They will be forbidden in future Python versions.
- gh-142206: The resource tracker in the multiprocessing
module now uses the original communication protocol, as in
Python 3.14.0 and below, by default. This avoids issues
with upgrading Python while it is running. (Note that such
‘in-place’ upgrades are not tested.) The tracker remains
compatible with subprocesses that use new protocol (that
is, subprocesses using Python 3.13.10, 3.14.1 and 3.15).
* Core and Builtins
- gh-142218: Fix crash when inserting into a split table
dictionary with a non str key that matches an existing key.
- Version to 3.13.10:
* Security
- gh-137836: Add support of the “plaintext” element, RAWTEXT
elements “xmp”, “iframe”, “noembed” and “noframes”, and
optionally RAWTEXT element “noscript” in
html.parser.HTMLParser.
- gh-136063: email.message: ensure linear complexity for
legacy HTTP parameters parsing. Patch by Bénédikt Tran.
* Library
- gh-74389: When the stdin being used by a subprocess.Popen
instance is closed, this is now ignored in
subprocess.Popen.communicate() instead of leaving the class
in an inconsistent state.
- gh-87512: Fix subprocess.Popen.communicate() timeout
handling on Windows when writing large input. Previously,
the timeout was ignored during stdin writing, causing the
method to block indefinitely if the child process did not
consume input quickly. The stdin write is now performed in
a background thread, allowing the timeout to be properly
enforced.
- gh-141473: When subprocess.Popen.communicate() was called
with input and a timeout and is called for a second time
after a TimeoutExpired exception before the process has
died, it should no longer hang.
- gh-59000: Fix pdb breakpoint resolution for class methods
when the module defining the class is not imported.
- gh-141570: Support file-like object raising OSError from
fileno() in color detection (_colorize.can_colorize()).
This can occur when sys.stdout is redirected.
- gh-141659: Fix bad file descriptor errors from
_posixsubprocess on AIX.
- gh-141497: ipaddress: ensure that the methods
IPv4Network.hosts() and IPv6Network.hosts() always return
an iterator.
- gh-140938: The statistics.stdev() and statistics.pstdev()
functions now raise a ValueError when the input contains an
infinity or a NaN.
- gh-124111: Updated Tcl threading configuration in _tkinter
to assume that threads are always available in Tcl 9 and
later.
- gh-137109: The os.fork and related forking APIs will no
longer warn in the common case where Linux or macOS
platform APIs return the number of threads in a process and
find the answer to be 1 even when a os.register_at_fork()
after_in_parent= callback (re)starts a thread.
- gh-141314: Fix assertion failure in io.TextIOWrapper.tell()
when reading files with standalone carriage return (\r)
line endings.
- gh-141311: Fix assertion failure in io.BytesIO.readinto()
and undefined behavior arising when read position is above
capcity in io.BytesIO.
- gh-141141: Fix a thread safety issue with
base64.b85decode(). Contributed by Benel Tayar.
- gh-140911: collections: Ensure that the methods
UserString.rindex() and UserString.index() accept
collections.UserString instances as the sub argument.
- gh-140797: The undocumented re.Scanner class now forbids
regular expressions containing capturing groups in its
lexicon patterns. Patterns using capturing groups could
previously lead to crashes with segmentation fault. Use
non-capturing groups (?:…) instead.
- gh-140815: faulthandler now detects if a frame or a code
object is invalid or freed. Patch by Victor Stinner.
- gh-100218: Correctly set errno when socket.if_nametoindex()
or socket.if_indextoname() raise an OSError. Patch by
Bénédikt Tran.
- gh-140875: Fix handling of unclosed character references
(named and numerical) followed by the end of file in
html.parser.HTMLParser with convert_charrefs=False.
- gh-140734: multiprocessing: fix off-by-one error when
checking the length of a temporary socket file path. Patch
by Bénédikt Tran.
- gh-140874: Bump the version of pip bundled in ensurepip to
version 25.3
- gh-140691: In urllib.request, when opening a FTP URL fails
because a data connection cannot be made, the control
connection’s socket is now closed to avoid
a ResourceWarning.
- gh-103847: Fix hang when cancelling process created by
asyncio.create_subprocess_exec() or
asyncio.create_subprocess_shell(). Patch by Kumar Aditya.
- gh-140590: Fix arguments checking for the
functools.partial.__setstate__() that may lead to internal
state corruption and crash. Patch by Sergey Miryanov.
- gh-140634: Fix a reference counting bug in
os.sched_param.__reduce__().
- gh-140633: Ignore AttributeError when setting a module’s
__file__ attribute when loading an extension module
packaged as Apple Framework.
- gh-140593: xml.parsers.expat: Fix a memory leak that could
affect users with ElementDeclHandler() set to a custom
element declaration handler. Patch by Sebastian Pipping.
- gh-140607: Inside io.RawIOBase.read(), validate that the
count of bytes returned by io.RawIOBase.readinto() is valid
(inside the provided buffer).
- gh-138162: Fix logging.LoggerAdapter with merge_extra=True
and without the extra argument.
- gh-140474: Fix memory leak in array.array when creating
arrays from an empty str and the u type code.
- gh-140272: Fix memory leak in the clear() method of the
dbm.gnu database.
- gh-140041: Fix import of ctypes on Android and Cygwin when
ABI flags are present.
- gh-139905: Add suggestion to error message for
typing.Generic subclasses when cls.__parameters__ is
missing due to a parent class failing to call
super().__init_subclass__() in its __init_subclass__.
- gh-139845: Fix to not print KeyboardInterrupt twice in
default asyncio REPL.
- gh-139783: Fix inspect.getsourcelines() for the case when
a decorator is followed by a comment or an empty line.
- gh-70765: http.server: fix default handling of HTTP/0.9
requests in BaseHTTPRequestHandler. Previously,
BaseHTTPRequestHandler.parse_request() incorrectly waited
for headers in the request although those are not supported
in HTTP/0.9. Patch by Bénédikt Tran.
- gh-139391: Fix an issue when, on non-Windows platforms, it
was not possible to gracefully exit a python -m asyncio
process suspended by Ctrl+Z and later resumed by fg other
than with kill.
- gh-101828: Fix 'shift_jisx0213', 'shift_jis_2004',
'euc_jisx0213' and 'euc_jis_2004' codecs truncating null
chars as they were treated as part of multi-character
sequences.
- gh-139246: fix: paste zero-width in default repl width is
wrong.
- gh-90949: Add SetAllocTrackerActivationThreshold() and
SetAllocTrackerMaximumAmplification() to xmlparser objects
to prevent use of disproportional amounts of dynamic memory
from within an Expat parser. Patch by Bénédikt Tran.
- gh-139065: Fix trailing space before a wrapped long word if
the line length is exactly width in textwrap.
- gh-138993: Dedent credits text.
- gh-138859: Fix generic type parameterization raising
a TypeError when omitting a ParamSpec that has a default
which is not a list of types.
- gh-138775: Use of python -m with base64 has been fixed to
detect input from a terminal so that it properly notices
EOF.
- gh-98896: Fix a failure in multiprocessing resource_tracker
when SharedMemory names contain colons. Patch by Rani
Pinchuk.
- gh-75989: tarfile.TarFile.extractall() and
tarfile.TarFile.extract() now overwrite symlinks when
extracting hardlinks. (Contributed by Alexander Enrique
Urieles Nieto in gh-75989.)
- gh-83424: Allows creating a ctypes.CDLL without name when
passing a handle as an argument.
- gh-136234: Fix asyncio.WriteTransport.writelines() to be
robust to connection failure, by using the same behavior as
write().
- gh-136057: Fixed the bug in pdb and bdb where next and step
can’t go over the line if a loop exists in the line.
- gh-135307: email: Fix exception in set_content() when
encoding text and max_line_length is set to 0 or None
(unlimited).
- gh-134453: Fixed subprocess.Popen.communicate() input=
handling of memoryview instances that were non-byte shaped
on POSIX platforms. Those are now properly cast to a byte
shaped view instead of truncating the input. Windows
platforms did not have this bug.
- gh-102431: Clarify constraints for “logical” arguments in
methods of decimal.Context.
* IDLE
- gh-96491: Deduplicate version number in IDLE shell title
bar after saving to a file.
* Core and Builtins
- gh-142048: Fix quadratically increasing garbage collection
delays in free-threaded build.
- gh-141930: When importing a module, use Python’s regular
file object to ensure that writes to .pyc files are
complete or an appropriate error is raised.
- gh-120158: Fix inconsistent state when enabling or
disabling monitoring events too many times.
- gh-141579: Fix sys.activate_stack_trampoline() to properly
support the perf_jit backend. Patch by Pablo Galindo.
- gh-141312: Fix the assertion failure in the __setstate__
method of the range iterator when a non-integer argument is
passed. Patch by Sergey Miryanov.
- gh-140939: Fix memory leak when bytearray or bytes is
formated with the
%*b format with a large width that results in
%a MemoryError.
- gh-140530: Fix a reference leak when raise exc from cause
fails. Patch by Bénédikt Tran.
- gh-140576: Fixed crash in tokenize.generate_tokens() in
case of specific incorrect input. Patch by Mikhail Efimov.
- gh-140551: Fixed crash in dict if dict.clear() is called at
the lookup stage. Patch by Mikhail Efimov and Inada Naoki.
- gh-140471: Fix potential buffer overflow in ast.AST node
initialization when encountering malformed _fields
containing non-str.
- gh-140406: Fix memory leak when an object’s __hash__()
method returns an object that isn’t an int.
- gh-140306: Fix memory leaks in cross-interpreter channel
operations and shared namespace handling.
- gh-140301: Fix memory leak of PyConfig in subinterpreters.
- gh-140000: Fix potential memory leak when a reference cycle
exists between an instance of typing.TypeAliasType,
typing.TypeVar, typing.ParamSpec, or typing.TypeVarTuple
and its __name__ attribute. Patch by Mikhail Efimov.
- gh-139748: Fix reference leaks in error branches of
functions accepting path strings or bytes such as compile()
and os.system(). Patch by Bénédikt Tran.
- gh-139516: Fix lambda colon erroneously start format spec
in f-string in tokenizer.
- gh-139640: Fix swallowing some syntax warnings in different
modules if they accidentally have the same message and are
emitted from the same line. Fix duplicated warnings in the
finally block.
- gh-137400: Fix a crash in the free threading build when
disabling profiling or tracing across all threads with
PyEval_SetProfileAllThreads() or
PyEval_SetTraceAllThreads() or their Python equivalents
threading.settrace_all_threads() and
threading.setprofile_all_threads().
- gh-133400: Fixed Ctrl+D (^D) behavior in _pyrepl module to
match old pre-3.13 REPL behavior.
* C API
- gh-140042: Removed the sqlite3_shutdown call that could
cause closing connections for sqlite when used with
multiple sub interpreters.
- gh-140487: Fix Py_RETURN_NOTIMPLEMENTED in limited C API
3.11 and older: don’t treat Py_NotImplemented as immortal.
Patch by Victor Stinner.CVSSUnscored