CVE-2022-42919
HighSummary
A vulnerability in Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The multiprocessing library with the forkserver start method permits pickle deserialization from any user on the same local network of the machine.
Risk Assessment
The risk involves potential arbitrary code execution by an unauthorized local user, which could lead to control over Python processes and privilege escalation on the system.
Recommendation
Immediately upgrade Python to version 3.9.16 or later (for 3.9 series) and 3.10.9 or later (for 3.10 series). In the meantime, avoid using the forkserver method with the multiprocessing library in multi-user environments.
Other vulnerabilities in Python
See all- CVE-2013-7338High
Python versions before 3.3.4 RC1 allow remote attackers to cause a denial of service via a file size value larger than the size of the zip file in functions related to reading and extracting zip files.
- CVE-2023-27043Medium
The email module in Python through 3.11.3 incorrectly parses email addresses containing special characters. The wrong portion of an RFC2822 header is identified as the value of the addr-spec.
- CVE-2023-24329High
A vulnerability in the urllib.parse component of Python before version 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
- CVE-2026-1299Medium
The email module in Python, specifically the BytesGenerator class, improperly quotes newlines in email headers during serialization, allowing header injection. This only affects usage of LiteralHeader that does not respect email folding.
- CVE-2022-0391High
A flaw was found in Python's urllib.parse module where the urlparse method does not sanitize input, allowing characters like ' ' and ' ' in the URL path. This can lead to CRLF injection attacks.
- CVE-2026-15310Low
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
- CVE-2026-17084Medium
The 'stringprep' module did not process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This causes mismatches when processing domain names using IDNA 2003 (the 'idna' codec) and the in_table_b2() function of the 'stringprep' module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
- CVE-2026-18503Low
A vulnerability in Python's csv.Sniffer where attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing, consuming significant CPU.
- CVE-2026-15308High
The incremental HTML parser (html.parser.HTMLParser) allows CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
- CVE-2026-12003Medium
CVE-2026-12003 vulnerability concerns how Python handles the VPATH variable during builds from the source tree. On Windows, VPATH may point to a location outside the Python installation directory, potentially allowing low-privilege users to create files that could be used to access an alternative `Lib` folder.
Original NVD description (English source)
Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network na