{"id":"USN-8509-1","summary":"python3.10, python3.12, python3.14 vulnerabilities","details":"It was discovered that Python incorrectly normalized paths in the tarfile\nmodule. An attacker could possibly use this issue to bypass path\nrestrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04\nLTS. (CVE-2025-13462)\n\nIt was discovered that Python's HTMLParser incorrectly handled certain\nmalformed HTML input. An attacker could possibly use this issue to cause\nPython to crash, resulting in a denial of service. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)\n\nIt was discovered that Python's email module incorrectly quoted newlines\nin headers. An attacker could possibly use this issue to inject arbitrary\nemail headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2026-1299)\n\nIt was discovered that Python's http.client module did not properly\nsanitize carriage return and linefeed characters when handling HTTP\nCONNECT tunnel request headers. An attacker could possibly use this issue\nto inject arbitrary HTTP headers. (CVE-2026-1502)\n\nIt was discovered that Python's importlib module did not generate an\naudit event when loading legacy .pyc files. An attacker could possibly\nuse this issue to bypass auditing mechanisms. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)\n\nIt was discovered that Python's unicodedata.normalize() function had\nincorrect algorithmic complexity. An attacker could possibly use this\nissue to cause Python to consume excessive resources, leading to a denial\nof service. (CVE-2026-3276)\n\nIt was discovered that Python's http.cookies module incorrectly handled\ncontrol characters in certain cookie operations. An attacker could possibly\nuse this issue to inject arbitrary content. This issue only affected Ubuntu\n22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)\n\nIt was discovered that the Python pyexpat module was vulnerable to\nunbounded recursion in the Expat XML parser. An attacker could possibly use\nthis issue to cause Python to crash, resulting in a denial of service. This\nissue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)\n\nIt was discovered that Python's webbrowser module accepted leading dashes\nin URLs, which could be interpreted as command-line options. An attacker\ncould possibly use this issue to execute arbitrary commands. This issue\nonly affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)\n\nIt was discovered that Python incorrectly handled webbrowser.open()\nhandlers. An attacker could possibly use this issue to execute arbitrary\ncommands. (CVE-2026-4786)\n\nIt was discovered that Python's remote debugging module did not properly\nvalidate offset tables when loading debug information. An attacker could\npossibly use this issue to cause Python to crash or execute arbitrary\ncode. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)\n\nIt was discovered that Python's http.cookies module incorrectly escaped\nvalues in the js_output() method. An attacker could possibly use this issue\nto inject arbitrary JavaScript. (CVE-2026-6019)\n\nIt was discovered that Python's lzma, bz2, and gzip decompressor objects\nhad a use-after-free vulnerability. An attacker could possibly use this\nissue to cause Python to crash or execute arbitrary code. (CVE-2026-6100)\n\nIt was discovered that Python's tarfile module did not properly validate\nlink targets when using the data filter. An attacker could possibly use\nthis issue to bypass path restrictions. This issue only affected Ubuntu\n24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)\n\nIt was discovered that the fix for CVE-2021-4189 in Python's ftplib module\nwas incomplete, allowing PASV responses to be used in ftplib.ftpcp(). An\nattacker could possibly use this issue to perform server-side request\nforgery attacks. (CVE-2026-8328)\n\nIt was discovered that Python's bz2 module allowed reuse of a\nBZ2Decompressor object after a decompression error. An attacker could\npossibly use this issue to cause Python to crash or execute arbitrary\ncode. (CVE-2026-9669)","modified":"2026-07-06T20:34:33.278982385Z","published":"2026-07-06T11:48:55Z","related":["UBUNTU-CVE-2021-4189","UBUNTU-CVE-2025-13462","UBUNTU-CVE-2025-69534","UBUNTU-CVE-2026-0672","UBUNTU-CVE-2026-1299","UBUNTU-CVE-2026-1502","UBUNTU-CVE-2026-2297","UBUNTU-CVE-2026-3276","UBUNTU-CVE-2026-3644","UBUNTU-CVE-2026-4224","UBUNTU-CVE-2026-4519","UBUNTU-CVE-2026-4786","UBUNTU-CVE-2026-5713","UBUNTU-CVE-2026-6019","UBUNTU-CVE-2026-6100","UBUNTU-CVE-2026-7774","UBUNTU-CVE-2026-8328","UBUNTU-CVE-2026-9669"],"upstream":["CVE-2021-4189","CVE-2025-13462","CVE-2025-69534","CVE-2026-0672","CVE-2026-1299","CVE-2026-1502","CVE-2026-2297","CVE-2026-3276","CVE-2026-3644","CVE-2026-4224","CVE-2026-4519","CVE-2026-4786","CVE-2026-5713","CVE-2026-6019","CVE-2026-6100","CVE-2026-7774","CVE-2026-8328","CVE-2026-9669","UBUNTU-CVE-2021-4189","UBUNTU-CVE-2025-13462","UBUNTU-CVE-2025-69534","UBUNTU-CVE-2026-0672","UBUNTU-CVE-2026-1299","UBUNTU-CVE-2026-1502","UBUNTU-CVE-2026-2297","UBUNTU-CVE-2026-3276","UBUNTU-CVE-2026-3644","UBUNTU-CVE-2026-4224","UBUNTU-CVE-2026-4519","UBUNTU-CVE-2026-4786","UBUNTU-CVE-2026-5713","UBUNTU-CVE-2026-6019","UBUNTU-CVE-2026-6100","UBUNTU-CVE-2026-7774","UBUNTU-CVE-2026-8328","UBUNTU-CVE-2026-9669"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8509-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-4189"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-13462"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-69534"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-0672"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-1299"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-1502"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-2297"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-3276"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-3644"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-4224"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-4519"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-4786"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-5713"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-6019"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-6100"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-7774"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-8328"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-9669"}],"affected":[{"package":{"name":"python3.10","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/python3.10?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.12-1~22.04.16"}]}],"versions":["3.10.0-2","3.10.0-3","3.10.0-4","3.10.0-5","3.10.0-5build1","3.10.1-1","3.10.1-2","3.10.2-1","3.10.2-5","3.10.2-7","3.10.3-1","3.10.4-3","3.10.4-3ubuntu0.1","3.10.6-1~22.04","3.10.6-1~22.04.1","3.10.6-1~22.04.2","3.10.6-1~22.04.2ubuntu1","3.10.6-1~22.04.2ubuntu1.1","3.10.12-1~22.04.2","3.10.12-1~22.04.3","3.10.12-1~22.04.4","3.10.12-1~22.04.5","3.10.12-1~22.04.6","3.10.12-1~22.04.7","3.10.12-1~22.04.8","3.10.12-1~22.04.9","3.10.12-1~22.04.10","3.10.12-1~22.04.11","3.10.12-1~22.04.12","3.10.12-1~22.04.13","3.10.12-1~22.04.14","3.10.12-1~22.04.15"],"ecosystem_specific":{"binaries":[{"binary_version":"3.10.12-1~22.04.16","binary_name":"idle-python3.10"},{"binary_version":"3.10.12-1~22.04.16","binary_name":"libpython3.10"},{"binary_version":"3.10.12-1~22.04.16","binary_name":"libpython3.10-minimal"},{"binary_version":"3.10.12-1~22.04.16","binary_name":"libpython3.10-stdlib"},{"binary_version":"3.10.12-1~22.04.16","binary_name":"libpython3.10-testsuite"},{"binary_version":"3.10.12-1~22.04.16","binary_name":"python3.10"},{"binary_version":"3.10.12-1~22.04.16","binary_name":"python3.10-examples"},{"binary_version":"3.10.12-1~22.04.16","binary_name":"python3.10-full"},{"binary_version":"3.10.12-1~22.04.16","binary_name":"python3.10-minimal"},{"binary_version":"3.10.12-1~22.04.16","binary_name":"python3.10-nopie"},{"binary_version":"3.10.12-1~22.04.16","binary_name":"python3.10-venv"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8509-1.json","cves_map":{"ecosystem":"Ubuntu:22.04:LTS","cves":[{"id":"CVE-2025-13462","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2025-69534","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-1299","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-1502","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-2297","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-3276","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-3644","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-4224","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-4519","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-4786","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-6019","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-6100","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-8328","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-9669","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}]}}},{"package":{"name":"python3.12","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/python3.12?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.3-1ubuntu0.15"}]}],"versions":["3.12.0-1","3.12.0-5","3.12.0-6","3.12.0-7","3.12.1-2","3.12.2-1","3.12.2-4build3","3.12.2-4build4","3.12.2-5ubuntu3","3.12.3-1","3.12.3-1ubuntu0.1","3.12.3-1ubuntu0.2","3.12.3-1ubuntu0.3","3.12.3-1ubuntu0.4","3.12.3-1ubuntu0.5","3.12.3-1ubuntu0.6","3.12.3-1ubuntu0.7","3.12.3-1ubuntu0.8","3.12.3-1ubuntu0.9","3.12.3-1ubuntu0.10","3.12.3-1ubuntu0.11","3.12.3-1ubuntu0.12","3.12.3-1ubuntu0.13"],"ecosystem_specific":{"binaries":[{"binary_version":"3.12.3-1ubuntu0.15","binary_name":"idle-python3.12"},{"binary_version":"3.12.3-1ubuntu0.15","binary_name":"libpython3.12-minimal"},{"binary_version":"3.12.3-1ubuntu0.15","binary_name":"libpython3.12-stdlib"},{"binary_version":"3.12.3-1ubuntu0.15","binary_name":"libpython3.12-testsuite"},{"binary_version":"3.12.3-1ubuntu0.15","binary_name":"libpython3.12t64"},{"binary_version":"3.12.3-1ubuntu0.15","binary_name":"python3.12"},{"binary_version":"3.12.3-1ubuntu0.15","binary_name":"python3.12-examples"},{"binary_version":"3.12.3-1ubuntu0.15","binary_name":"python3.12-full"},{"binary_version":"3.12.3-1ubuntu0.15","binary_name":"python3.12-minimal"},{"binary_version":"3.12.3-1ubuntu0.15","binary_name":"python3.12-nopie"},{"binary_version":"3.12.3-1ubuntu0.15","binary_name":"python3.12-venv"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8509-1.json","cves_map":{"ecosystem":"Ubuntu:24.04:LTS","cves":[{"id":"CVE-2025-13462","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2025-69534","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-1299","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-1502","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-2297","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-3276","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-3644","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-4224","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-4519","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-4786","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-6019","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-6100","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-7774","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-8328","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-9669","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}]}}},{"package":{"name":"python3.14","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/python3.14?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-1ubuntu0.1"}]}],"versions":["3.14.0-1","3.14.0-2","3.14.0-4","3.14.2-1","3.14.3-1","3.14.3-2","3.14.3-3","3.14.3-5","3.14.4-1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"idle-python3.14"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"libpython3.14"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"libpython3.14-minimal"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"libpython3.14-stdlib"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"libpython3.14-testsuite"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"python3.14"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"python3.14-examples"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"python3.14-full"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"python3.14-gdbm"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"python3.14-minimal"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"python3.14-nopie"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"python3.14-tk"},{"binary_version":"3.14.4-1ubuntu0.1","binary_name":"python3.14-venv"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8509-1.json","cves_map":{"ecosystem":"Ubuntu:26.04:LTS","cves":[{"id":"CVE-2026-1502","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-3276","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-4786","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-5713","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-6019","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-6100","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-7774","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-8328","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-9669","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}]}}}],"schema_version":"1.7.5"}