products / python

Python

CPython is the reference Python interpreter used for application servers, data pipelines, and CLI tooling. CVE coverage spans the standard library, including urllib, zipfile, and _ctypes. Attestd queries NVD through cpe:2.3:a:python:python as the primary namespace. NVD also publishes cpe:2.3:a:python:cpython as a secondary product identifier for some advisories.

api usage

Querying Python

product slugpython

version format3.11.0, 3.13.0, 3.9.18

bash

curl "https://api.attestd.io/v1/check?product=python&version=3.11.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Python 3.11.0 is affected by CVE-2023-24329 (urllib blank-character blocklist bypass). The aggregated response returns risk_state high for this version.

json

{
  "product": "python",
  "version": "3.11.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.45,
  "cve_ids": [
    "CVE-2007-4559",
    "CVE-2020-10735",
    "CVE-2021-28861",
    "CVE-2022-26488",
    "CVE-2022-45061",
    "CVE-2023-24329",
    "CVE-2023-27043",
    "CVE-2023-36632",
    "CVE-2023-40217",
    "CVE-2023-41105",
    "CVE-2024-12718",
    "CVE-2024-6232",
    "CVE-2024-7592",
    "CVE-2024-9287",
    "CVE-2025-0938",
    "CVE-2025-12084",
    "CVE-2025-12781",
    "CVE-2025-13462",
    "CVE-2025-13836",
    "CVE-2025-13837",
    "CVE-2025-4138",
    "CVE-2025-4330",
    "CVE-2025-4517",
    "CVE-2025-6075",
    "CVE-2026-11386",
    "CVE-2026-12003",
    "CVE-2026-15308",
    "CVE-2026-29509",
    "CVE-2026-3087",
    "CVE-2026-3644",
    "CVE-2026-4519",
    "CVE-2026-5713",
    "CVE-2026-6019",
    "CVE-2026-61433",
    "CVE-2026-64824",
    "CVE-2026-65908",
    "CVE-2026-68770",
    "CVE-2026-71259",
    "CVE-2026-7210",
    "CVE-2026-8169",
    "CVE-2026-9147"
  ],
  "cves": null,
  "max_epss": 0.27095,
  "last_updated": "2026-08-05T17:32:48.621326Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Python 3.13.0 is outside the CVE-2023-24329 and CVE-2024-0450 fixed ranges for current 3.x lines.

bash

curl "https://api.attestd.io/v1/check?product=python&version=3.13.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

CPython advisories concentrate in the standard library rather than the interpreter core. urllib parsing, zipfile resource limits, and C-extension edge cases such as _ctypes produce the highest-severity CVEs. Fixes ship as micro releases on each supported 3.x line.

CVE	Description	Affects	CVSS
`CVE-2021-3177`	Buffer overflow in _ctypes PyCArg_repr allows remote code execution when untrusted floats reach c_double.from_param.	3.6.0–3.9.1	9.8
`CVE-2019-9636`	Improper Unicode NFKC handling in urllib.parse discloses credentials or cookies to the wrong host.	2.7 / early 3.x	9.8
`CVE-2023-24329`	Leading blank characters in URLs bypass urllib blocklist checks.	<3.11.4 (and earlier lines)	7.5
`CVE-2024-0450`	Crafted zip bombs exhaust resources via the zipfile module.	<3.11.8 (and earlier)	6.2

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Primary and secondary CPE namespaces

NVD lists CPython under two CPE product identifiers:

cpe:2.3:a:python:pythonPrimary namespace for most stdlib CVEs

cpe:2.3:a:python:cpythonSecondary namespace on some advisories

Attestd treats python:python as the primary filter and merges matching python:cpython rows on CVE ID so a single check covers both namespaces.

All products Ruby PHP Quickstart