CVE-2026-3298
highPriorität · verfolgen · 0EPSS 0.004 · 33. PerzentilDEEUFRUSEPSS · bewertet 2026-10-27
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.8–8.8
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (19)
Betroffene Produkte und Versionsbereiche.
Advisories (7)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-1222CPython: Schwachstelle ermöglicht nicht spezifizierten AngriffDeutsch2026-04-21csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in CPython ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- BIT-libpython-2026-3298Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes2026-07-06vendor · osvUS
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- BIT-python-2026-3298Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes2026-07-06vendor · osvUS
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- BIT-python-min-2026-3298Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes2026-07-06vendor · osvUS
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- PSF-0000-CVE-2026-32982026-04-21vendor · osvUS
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- PSF-2026-202026-04-21vendor · osvUS
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
auch bekannt als (8)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202604-4086cnnvd
- EUVD-2026-24136enisa_euvd
- GHSA-3p9c-22jr-wq4xenisa_euvd
- BIT-libpython-2026-3298osv
- BIT-python-2026-3298osv
- BIT-python-min-2026-3298osv
- PSF-0000-CVE-2026-3298osv
- PSF-2026-20osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (19)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2026-3298cnnvd
- https://github.com/python/cpython/tagsPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-3298cnnvd
- https://github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4denisa_euvd
- https://github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2enisa_euvd
- https://github.com/python/cpython/commit/6c8b85b3f1d83d5697ec19880960e1eacee56688enisa_euvd
- https://github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741enisa_euvd
- https://github.com/python/cpython/commit/f5ca38739241fe7a40a4b116d5a8a1364dd6fea7enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan