CVE-2026-4519: Python Software Foundation CPython

Affected products, as the CNA wrote them
Vendor	Product	Versions
Python Software Foundation	CPython	affected before 3.10.21 python affected 3.11.0 to before 3.11.16 python affected 3.12.0 to before 3.12.14 python affected 3.13.0 to before 3.13.13 python affected 3.14.0 to before 3.14.4 python affected 3.15.0a1 to before 3.15.0a8 python Other versions: unaffected

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.0	High	4.0	CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	CNA (PSF)Used for this record
7.1	High	3.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L	ADP (redhat-SADP)

CISA KEV Not listed.
EPSS 0.0031, the 24th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 20 Mar 2026. New records show when each source confirmed them.

Sources

CVE List: CVE-2026-4519
NVD: CVE-2026-4519

References from the CNA

github.com/python/cpython/pull/143931 patch
github.com/python/cpython/issues/143930 issue-tracking
mail.python.org/archives/list/[email protected]/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/ vendor-advisory
github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866 patch
github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b patch
github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76 patch
github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5 patch
github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03 patch
github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48 patch
github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd patch
github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e patch
github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1 patch
github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4 patch
github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c patch
github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932 patch

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.