{"schemaVersion":3,"id":"USN-8744-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"python2.7, python3.4, python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12, python3.14 vulnerabilities\n\nIt was discovered that Python's http.cookies module incorrectly handled\ncontrol characters in certain cookie operations. An attacker could possibly\nuse this issue to inject arbitrary content. This issue only affected\nUbuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)\n\nIt was discovered that the Python pyexpat module was vulnerable to\nunbounded recursion in the Expat XML parser. An attacker could possibly use\nthis issue to cause Python to crash, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)\n\nIt was discovered that Python's tarfile module did not correctly apply the\nfilter parameter when extracting hard links. An attacker could possibly use\nthis issue to cause files to be extracted with an unexpected uid or gid,\nbypassing the restrictions requested via filter='data'. (CVE-2026-4360)\n\nIt was discovered that Python's http.cookies module incorrectly escaped\nvalues in the js_output() method. An attacker could possibly use this issue\nto inject arbitrary JavaScript. (CVE-2026-6019)\n\nIt was discovered that Python's html.parser module incorrectly handled\nrepeated unterminated markup declarations. An attacker could possibly use\nthis issue to cause Python to consume excessive CPU resources, leading to a\ndenial of service. (CVE-2026-15308)","dates":{"published":"2026-09-10T13:53:24.000Z","modified":"2026-09-15T14:30:34.591Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"python2.7","name":"python2.7","label":"python2.7","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python2.7","purlType":"deb","versions":[{"text":"< 2.7.6-8ubuntu0.6+esm30","noFixRecorded":false,"fixedIn":null},{"text":"< 2.7.12-1ubuntu0~16.04.18+esm22","noFixRecorded":false,"fixedIn":null},{"text":"< 2.7.17-1~18.04ubuntu1.13+esm15","noFixRecorded":false,"fixedIn":null},{"text":"< 2.7.18-1~20.04.7+esm10","noFixRecorded":false,"fixedIn":null},{"text":"< 2.7.18-13ubuntu1.5+esm9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.6-8ubuntu0.6+esm30 | < 2.7.12-1ubuntu0~16.04.18+esm22 | < 2.7.17-1~18.04ubuntu1.13+esm15 | < 2.7.18-1~20.04.7+esm10 | < 2.7.18-13ubuntu1.5+esm9","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python3.10","name":"python3.10","label":"python3.10","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python3.10","purlType":"deb","versions":[{"text":"< 3.10.12-1~22.04.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.12-1~22.04.18","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python3.11","name":"python3.11","label":"python3.11","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python3.11","purlType":"deb","versions":[{"text":"< 3.11.0~rc1-1~22.04.1+esm2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.11.0~rc1-1~22.04.1+esm2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python3.12","name":"python3.12","label":"python3.12","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python3.12","purlType":"deb","versions":[{"text":"< 3.12.3-1ubuntu0.17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.12.3-1ubuntu0.17","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python3.14","name":"python3.14","label":"python3.14","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python3.14","purlType":"deb","versions":[{"text":"< 3.14.4-1ubuntu0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.14.4-1ubuntu0.2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python3.4","name":"python3.4","label":"python3.4","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python3.4","purlType":"deb","versions":[{"text":"< 3.4.3-1ubuntu1~14.04.7+esm21","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.3-1ubuntu1~14.04.7+esm21","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python3.5","name":"python3.5","label":"python3.5","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python3.5","purlType":"deb","versions":[{"text":"< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm11","noFixRecorded":false,"fixedIn":null},{"text":"< 3.5.2-2ubuntu0~16.04.13+esm25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm11 | < 3.5.2-2ubuntu0~16.04.13+esm25","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python3.6","name":"python3.6","label":"python3.6","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python3.6","purlType":"deb","versions":[{"text":"< 3.6.9-1~18.04ubuntu1.13+esm10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.9-1~18.04ubuntu1.13+esm10","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python3.7","name":"python3.7","label":"python3.7","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python3.7","purlType":"deb","versions":[{"text":"< 3.7.5-2ubuntu1~18.04.2+esm11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.5-2ubuntu1~18.04.2+esm11","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python3.8","name":"python3.8","label":"python3.8","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python3.8","purlType":"deb","versions":[{"text":"< 3.8.0-3ubuntu1~18.04.2+esm11","noFixRecorded":false,"fixedIn":null},{"text":"< 3.8.10-0ubuntu1~20.04.18+esm7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.0-3ubuntu1~18.04.2+esm11 | < 3.8.10-0ubuntu1~20.04.18+esm7","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python3.9","name":"python3.9","label":"python3.9","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python3.9","purlType":"deb","versions":[{"text":"< 3.9.5-3ubuntu0~20.04.1+esm11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.9.5-3ubuntu0~20.04.1+esm11","eol":null,"hubHref":null}],"affectedCount":11,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8744-1","label":"ubuntu.com/security/notices/USN-8744-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-3644","label":"ubuntu.com/security/CVE-2026-3644","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-4224","label":"ubuntu.com/security/CVE-2026-4224","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-4360","label":"ubuntu.com/security/CVE-2026-4360","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-6019","label":"ubuntu.com/security/CVE-2026-6019","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-15308","label":"ubuntu.com/security/CVE-2026-15308","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2026-15308","CVE-2026-3644","CVE-2026-4224","CVE-2026-4360","CVE-2026-6019"],"downstream":[],"duplicates":[],"related":["CVE-2026-15308","CVE-2026-3644","CVE-2026-4224","CVE-2026-4360","CVE-2026-6019"]},"timeline":[{"kind":"published","date":"2026-09-10T13:53:24.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-15T14:30:34.591Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T14:27:20.283Z","stale":false,"partial":false}}