CVE-2026-2297

Name
CVE-2026-2297
Description
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cna@python.org https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e
cna@python.org https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e
cna@python.org https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86
cna@python.org https://github.com/python/cpython/issues/145506
cna@python.org https://github.com/python/cpython/pull/145507
af854a3a-2127-422b-91ae-364da2661108 http://www.openwall.com/lists/oss-security/2026/03/05/6
cna@python.org https://github.com/python/cpython/commit/69ddd9bb2cc4bd69b1565647c18659c6a789ccd9
cna@python.org https://github.com/python/cpython/commit/876858c9f65d9ab656c7fa639f268ce7856d89dd
cna@python.org https://github.com/python/cpython/commit/c70adad78caeeea33f92f560ecb93331ca11bf66

Match rules

CPE URI Source package Min version Max version

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
python3 edge-main 3.14.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.24-main 3.14.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.23-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.22-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.21-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed