USN-8509-1: Python vulnerabilities

It was discovered that Python incorrectly normalized paths in the tarfile
module. An attacker could possibly use this issue to bypass path
restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04
LTS. (CVE-2025-13462)

It was discovered that Python's HTMLParser incorrectly handled certain
malformed HTML input. An attacker could possibly use this issue to cause
Python to crash, resulting in a denial of service. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)

It was discovered that Python's email module incorrectly quoted newlines
in headers. An attacker could possibly use this issue to inject arbitrary
email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu
24.04 LTS. (CVE-2026-1299)

It was discovered that Python's http.client module did not properly
sanitize carriage return and linefeed characters when handling HTTP
CONNECT tunnel request headers. An attacker could possibly use this issue
to inject arbitrary HTTP headers. (CVE-2026-1502)

It was discovered that Python's importlib module did not generate an
audit event when loading legacy .pyc files. An attacker could possibly
use this issue to bypass auditing mechanisms. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)

It was discovered that Python's unicodedata.normalize() function had
incorrect algorithmic complexity. An attacker could possibly use this
issue to cause Python to consume excessive resources, leading to a denial
of service. (CVE-2026-3276)

It was discovered that Python's http.cookies module incorrectly handled
control characters in certain cookie operations. An attacker could possibly
use this issue to inject arbitrary content. This issue only affected Ubuntu
22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)

It was discovered that the Python pyexpat module was vulnerable to
unbounded recursion in the Expat XML parser. An attacker could possibly use
this issue to cause Python to crash, resulting in a denial of service. This
issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

It was discovered that Python's webbrowser module accepted leading dashes
in URLs, which could be interpreted as command-line options. An attacker
could possibly use this issue to execute arbitrary commands. This issue
only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)

It was discovered that Python incorrectly handled webbrowser.open()
handlers. An attacker could possibly use this issue to execute arbitrary
commands. (CVE-2026-4786)

It was discovered that Python's remote debugging module did not properly
validate offset tables when loading debug information. An attacker could
possibly use this issue to cause Python to crash or execute arbitrary
code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)

It was discovered that Python's http.cookies module incorrectly escaped
values in the js_output() method. An attacker could possibly use this issue
to inject arbitrary JavaScript. (CVE-2026-6019)

It was discovered that Python's lzma, bz2, and gzip decompressor objects
had a use-after-free vulnerability. An attacker could possibly use this
issue to cause Python to crash or execute arbitrary code. (CVE-2026-6100)

It was discovered that Python's tarfile module did not properly validate
link targets when using the data filter. An attacker could possibly use
this issue to bypass path restrictions. This issue only affected Ubuntu
24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)

It was discovered that the fix for CVE-2021-4189 in Python's ftplib module
was incomplete, allowing PASV responses to be used in ftplib.ftpcp(). An
attacker could possibly use this issue to perform server-side request
forgery attacks. (CVE-2026-8328)

It was discovered that Python's bz2 module allowed reuse of a
BZ2Decompressor object after a decompression error. An attacker could
possibly use this issue to cause Python to crash or execute arbitrary
code. (CVE-2026-9669)