CVE-2023-40217
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5, affecting servers using TLS client authentication. If a TLS server-side socket is closed quickly, data may still be readable from the socket buffer without authentication.
Risk Assessment
Organizations may be at risk of unauthorized access to data that can be read from the socket buffer, potentially leading to information security breaches.
Recommendation
It is recommended to update Python to the latest version to mitigate this vulnerability and to monitor TLS-using servers for potential incidents.
Other vulnerabilities in Python
See all- CVE-2013-7338High
Python versions before 3.3.4 RC1 allow remote attackers to cause a denial of service via a file size value larger than the size of the zip file in functions related to reading and extracting zip files.
- CVE-2022-0391High
A flaw was found in Python's urllib.parse module where the urlparse method does not sanitize input, allowing characters like ' ' and ' ' in the URL path. This can lead to CRLF injection attacks.
- CVE-2023-24329High
A vulnerability in the urllib.parse component of Python before version 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
- CVE-2026-1299Medium
The email module in Python, specifically the BytesGenerator class, improperly quotes newlines in email headers during serialization, allowing header injection. This only affects usage of LiteralHeader that does not respect email folding.
- CVE-2022-42919High
A vulnerability in Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The multiprocessing library with the forkserver start method permits pickle deserialization from any user on the same local network of the machine.
- CVE-2023-27043Medium
The email module in Python through 3.11.3 incorrectly parses email addresses containing special characters. The wrong portion of an RFC2822 header is identified as the value of the addr-spec.
- CVE-2026-15310Low
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
- CVE-2026-17084Medium
The 'stringprep' module did not process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This causes mismatches when processing domain names using IDNA 2003 (the 'idna' codec) and the in_table_b2() function of the 'stringprep' module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
- CVE-2026-18503Low
A vulnerability in Python's csv.Sniffer where attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing, consuming significant CPU.
- CVE-2026-15308High
The incremental HTML parser (html.parser.HTMLParser) allows CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
Original NVD description (English source)
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS