Seth Larson

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

webbrowser.open() allows leading dashes in URLs

Incomplete control character validation in http.cookies

HTTP client proxy tunnel headers not validated for CR/LF

Extraction filter bypass for linking outside extraction directory

Arbitrary writes via tarfile realpath overflow

Bypass extraction filter to modify file metadata outside extraction directory

Unbounded memory buffering in SelectorSocketTransport.writelines()

ZIP64 End of Central Directory (EOCD) Locator record offset not checked