Python Software Foundation · weakness class
Denial of Service
20 CVEs
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 20 is a mark on the map. Named now: 1 to 20, most at risk first.
- Quadratic complexity parsing cookies with backslashes
- Regular-expression DoS when parsing TarFile headers
- Unbounded memory buffering in SelectorSocketTransport.writelines()
- Excessive read buffering DoS in http.client
- The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via…
- An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by…
- Infinite loop when iterating over zip archive entry names from zipfile.Path
- Quadratic complexity in node ID cache clearing
- Stack overflow parsing XML with deeply nested DTD content models
- Tarfile infinite loop during parsing with negative member offset
- Denial of Service in Python Protobuf
- Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations
- HTMLParser quadratic complexity when processing malformed inputs
- zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
- Potential DoS via quadratic complexity in unicodedata.normalize()
- Quadratic Behavior in xml.etree.ElementPath Index Predicates
- Quoted zip-bomb protection for zipfile
- Out-of-memory when loading Plist
- Quadratic complexity in os.path.expandvars() with user-controlled template
- Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.