CVE-2026-3479: Python Software Foundation Cpython

None severity, CVSS 0.0. EPSS: 0.2% chance of exploitation in the next 30 days.

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.

Affected products

• Python Software Foundation Cpython: before 3.13.13 (fixed in 3.13.13); from 3.14.0, before 3.14.4 (fixed in 3.14.4); from 3.15.0a1, before 3.15.0a8 (fixed in 3.15.0a8)

Published 2026-03-18. Last modified 2026-06-17.