Low severity · published Oct 27, 2026
CVE-2026-103995
Lenient parsing of integers for response body and chunk framing
New
2.0
CVSS
–
EPSS
No
On KEV
Description
Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.16.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103995
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103995
github.com
https://github.com/python/cpython/issues/150751
github.com
https://github.com/python/cpython/pull/150752
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.4
CVE-2026-82049
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
8.2
CVE-2026-11972
tarfile opened in streaming mode mishandles EOF