CVE-2024-4032: Python Software Foundation CPython

Affected products, as the CNA wrote them
Vendor	Product	Versions
Python Software Foundation	CPython	affected before 3.8.20 python affected 3.9.0 to before 3.9.20 python affected 3.10.0 to before 3.10.15 python affected 3.11.0 to before 3.11.10 python affected 3.12.0 to before 3.12.4 python affected 3.13.0a1 to before 3.13.0a6 python Other versions: unaffected

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.5	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	ADP (CISA-ADP)

CISA KEV Not listed.
EPSS 0.011, the 65th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 17 Jun 2024. New records show when each source confirmed them.

Sources

CVE List: CVE-2024-4032
NVD: CVE-2024-4032

References from the CNA

github.com/python/cpython/issues/113171 issue-tracking
github.com/python/cpython/pull/113179 patch
www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
mail.python.org/archives/list/[email protected]/thread/NRUHDUS2IV2USIZM2CVMSFL6SCKU3RZA/ vendor-advisory
github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8 patch
github.com/python/cpython/commit/40d75c2b7f5c67e254d0a025e0f2e2c7ada7f69f patch
github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3 patch
github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb patch
github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906 patch
github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3 patch
www.openwall.com/lists/oss-security/2024/06/17/3
security.netapp.com/advisory/ntap-20240726-0004/

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.