Regular-expression DoS when parsing TarFile headers

Quadratic complexity parsing cookies with backslashes

Email header injection due to unquoted newlines

Incorrect IPv4 and IPv6 private ranges

tempfile.mkdtemp() may be readable and writeable by all users on Windows

Quoted zip-bomb protection for zipfile

Groups not dropped before running subprocess when using empty 'extra_groups' parameter

An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which …

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attac…