CVE-2026-8328

EUVD-2026-30177
The ftpcp() function in Lib/ftplib.py was not updated when 
CVE-2021-4189 was fixed. While makepasv() was patched to replace 
server-supplied PASV host addresses with the actual peer address 
(getpeername()[0]), ftpcp() still calls parse227() directly and passes 
the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
PSFCNA
5.9 MEDIUM
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 37.57%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
pythoncpython
𝑥
< 3.13.14
CNA
pythoncpython
3.14.0 ≤
𝑥
< 3.14.6
CNA
Debian logo
Debian Releases
Debian Product
Codename
pypy3
bookworm
no-dsa
bullseye
postponed
bullseye (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
no-dsa
python2.7
bullseye
vulnerable
python3.11
bookworm
no-dsa
bookworm (security)
vulnerable
python3.13
forky
3.13.14-1
fixed
sid
3.13.14-1
fixed
trixie
3.13.5-2+deb13u3
fixed
python3.14
forky
3.14.6-1
fixed
sid
3.14.6-1
fixed
python3.9
bullseye
postponed
bullseye (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python3.10
jammy
Fixed 3.10.12-1~22.04.16
released
noble
dne
questing
dne
resolute
dne
python3.12
jammy
dne
noble
Fixed 3.12.3-1ubuntu0.15
released
questing
dne
resolute
dne
python3.13
jammy
dne
noble
dne
questing
ignored
resolute
dne
python3.14
jammy
dne
noble
dne
questing
ignored
resolute
Fixed 3.14.4-1ubuntu0.1
released
python2.7
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
python3.11
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
python3.4
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
python3.5
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
python3.6
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.7
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.8
bionic
needs-triage
focal
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.9
focal
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpython3_10-1_0
suse enterprise server 15 SP4
3.10.20-150400.4.115.2
fixed
libpython3_11-1_0
suse enterprise desktop 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise sap 15 SP4
3.11.15-150400.9.94.2
fixed
suse enterprise sap 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP4
3.11.15-150400.9.94.2
fixed
suse enterprise server 15 SP5
3.11.15-150400.9.94.2
fixed
suse enterprise server 15 SP6
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP7
3.11.15-150600.3.62.2
fixed
libpython3_4m1_0
suse enterprise server 12 SP3
3.4.10-25.188.1
fixed
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
libpython3_4m1_0-32bit
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python3
suse enterprise server 12 SP3
3.4.10-25.188.1
fixed
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python3-base
suse enterprise server 12 SP3
3.4.10-25.188.1
fixed
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python3-curses
suse enterprise server 12 SP3
3.4.10-25.188.1
fixed
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python3-devel
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python3-tk
suse enterprise server 12 SP5
3.4.10-25.188.1
fixed
python310
suse enterprise server 15 SP4
3.10.20-150400.4.115.1
fixed
python310-base
suse enterprise server 15 SP4
3.10.20-150400.4.115.2
fixed
python310-curses
suse enterprise server 15 SP4
3.10.20-150400.4.115.1
fixed
python310-dbm
suse enterprise server 15 SP4
3.10.20-150400.4.115.1
fixed
python310-devel
suse enterprise server 15 SP4
3.10.20-150400.4.115.2
fixed
python310-idle
suse enterprise server 15 SP4
3.10.20-150400.4.115.1
fixed
python310-tk
suse enterprise server 15 SP4
3.10.20-150400.4.115.1
fixed
python310-tools
suse enterprise server 15 SP4
3.10.20-150400.4.115.2
fixed
python311
suse enterprise desktop 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise sap 15 SP4
3.11.15-150400.9.94.1
fixed
suse enterprise sap 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP4
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP5
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP6
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP7
3.11.15-150600.3.62.2
fixed
python311-base
suse enterprise desktop 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise sap 15 SP4
3.11.15-150400.9.94.2
fixed
suse enterprise sap 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP4
3.11.15-150400.9.94.2
fixed
suse enterprise server 15 SP5
3.11.15-150400.9.94.2
fixed
suse enterprise server 15 SP6
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP7
3.11.15-150600.3.62.2
fixed
python311-curses
suse enterprise desktop 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise sap 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP4
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP5
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP6
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP7
3.11.15-150600.3.62.2
fixed
python311-dbm
suse enterprise desktop 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise sap 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP4
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP5
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP6
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP7
3.11.15-150600.3.62.2
fixed
python311-devel
suse enterprise desktop 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise sap 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP4
3.11.15-150400.9.94.2
fixed
suse enterprise server 15 SP5
3.11.15-150400.9.94.2
fixed
suse enterprise server 15 SP6
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP7
3.11.15-150600.3.62.2
fixed
python311-doc
suse enterprise server 15 SP4
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP5
3.11.15-150400.9.94.1
fixed
python311-doc-devhelp
suse enterprise server 15 SP4
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP5
3.11.15-150400.9.94.1
fixed
python311-idle
suse enterprise desktop 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise sap 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP4
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP5
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP6
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP7
3.11.15-150600.3.62.2
fixed
python311-tk
suse enterprise desktop 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise sap 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP4
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP5
3.11.15-150400.9.94.1
fixed
suse enterprise server 15 SP6
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP7
3.11.15-150600.3.62.2
fixed
python311-tools
suse enterprise desktop 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise sap 15 SP7
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP4
3.11.15-150400.9.94.2
fixed
suse enterprise server 15 SP5
3.11.15-150400.9.94.2
fixed
suse enterprise server 15 SP6
3.11.15-150600.3.62.2
fixed
suse enterprise server 15 SP7
3.11.15-150600.3.62.2
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python-unversioned-command
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-debug
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-devel
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-idle
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-libs
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-test
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3-tkinter
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3.11
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-debug
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-debuginfo
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-debugsource
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-devel
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-idle
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-libs
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-test
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.11-tkinter
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.3
fixed
python3.12
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-debug
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-debuginfo
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-debugsource
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-devel
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-idle
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-libs
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-test
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.12-tkinter
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.3
fixed
python3.13
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-debug
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-debuginfo
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-debugsource
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-devel
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-freethreading
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-freethreading-debug
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-idle
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-libs
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-test
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-tkinter
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.14
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-debug
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-debuginfo
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-debugsource
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-devel
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-freethreading
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-freethreading-debug
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-freethreading-devel
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-freethreading-idle
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-freethreading-libs
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-freethreading-test
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-freethreading-tkinter
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-idle
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-libs
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-test
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.14-tkinter
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.1
fixed
python3.9-debuginfo
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
python3.9-debugsource
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.7
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
python3
Azure Linux 3.0
0:3.12.9-13.azl3
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f
https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06
https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0
https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763
https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d
https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9
https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb
https://github.com/python/cpython/issues/87451
https://github.com/python/cpython/pull/149648
https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/