CVE-2024-3219: Python Software Foundation CPython

Affected products, as the CNA wrote them
Vendor	Product	Versions
Python Software Foundation	CPython	affected before 3.8.20 python affected 3.9.0 to before 3.9.20 python affected 3.10.0 to before 3.10.15 python affected 3.11.0 to before 3.11.10 python affected 3.12.0 to before 3.12.5 python affected 3.13.0a1 to before 3.13.0rc1 python Other versions: unaffected

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
5.1	Medium	4.0	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	CNA (PSF)

CISA KEV Not listed.
EPSS 0.0025, the 16th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 29 Jul 2024. New records show when each source confirmed them.

Sources

CVE List: CVE-2024-3219
NVD: CVE-2024-3219

References from the CNA

github.com/python/cpython/pull/122134 patch
github.com/python/cpython/issues/122133 issue-tracking
mail.python.org/archives/list/[email protected]/thread/WYKDQWIERRE2ICIYMSVRZJO33GSCWU2B/ vendor-advisory
www.openwall.com/lists/oss-security/2024/07/29/3
github.com/python/cpython/commit/06fa244666ec6335a3b9bf2367e31b42b9a89b20 patch
github.com/python/cpython/commit/0b65c8bf5367625673eafb92f85046a1b31259f2 patch
github.com/python/cpython/commit/220e31adeaaa8436c9ff234cba1398bc49e2bb6c patch
github.com/python/cpython/commit/5f90abaa786f994db3907fc31e2ee00ea2cf0929 patch
github.com/python/cpython/commit/b252317956b7fc035bb3774ef6a177e227f9fc54 patch
github.com/python/cpython/commit/2621a8a40ba4b2c68ca564671b7daa5da80a4508 patch
github.com/python/cpython/commit/5df322e91a40909e6904bbdbc0c3a6b6a9eead39 patch
github.com/python/cpython/commit/c21a36112a0028d7ac3cf8f480e0dc88dba5922c patch
github.com/python/cpython/commit/f071f01b7b7e19d7d6b3a4b0ec62f820ecb14660 patch
github.com/python/cpython/commit/31302f5fc24eecd693f0c8aaba7c2840b09b594d patch
github.com/python/cpython/commit/3f5d9d12c74787fbf3f5891835c85cc15526c86d patch
github.com/python/cpython/commit/c5655aa6ad120d2ed7f255bebd6e8b71a9c07dde patch
github.com/python/cpython/commit/e319f774f9e766a2b92949444a2d46081df3363a patch
github.com/python/cpython/commit/78df1043dbdce5c989600616f9f87b4ee72944e5 patch

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.