CVE-2026-3298
Fixed in a distro release EPSS <1%CVSS 8.8
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
Products: Python Software Foundation CPython
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | python-3.10 | 0 |
| Chainguard | python-3.11 | 0 |
| Chainguard | python-3.12 | 0 |
| Chainguard | python-3.13 | 0 |
| Chainguard | python-3.14 | 0 |
| Wolfi | python-3.10 | 0 |
| Wolfi | python-3.11 | 0 |
| Wolfi | python-3.12 | 0 |
| Wolfi | python-3.13 | 0 |
| Wolfi | python-3.14 | 0 |