cpython-3.12.12-py312hd8ed1ab_1.conda: 9 vulnerabilities (highest severity is: 7.7) - autoclosed

[mend-bolt-for-github]

Vulnerable Library - cpython-3.12.12-py312hd8ed1ab_1.conda

General purpose programming language

Library home page: https://api.anaconda.org/download/conda-forge/cpython/3.12.12/noarch/cpython-3.12.12-py312hd8ed1ab_1.conda

Path to dependency file: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/cpython-3.12.12-py312hd8ed1ab_1.conda

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (cpython version)	Remediation Possible**
CVE-2025-15282	High	7.7	cpython-3.12.12-py312hd8ed1ab_1.conda	Direct	N/A	❌
CVE-2026-1299	High	7.1	cpython-3.12.12-py312hd8ed1ab_1.conda	Direct	N/A	❌
CVE-2026-0672	High	7.1	cpython-3.12.12-py312hd8ed1ab_1.conda	Direct	N/A	❌
CVE-2025-15367	Medium	5.5	cpython-3.12.12-py312hd8ed1ab_1.conda	Direct	N/A	❌
CVE-2025-15366	Medium	5.5	cpython-3.12.12-py312hd8ed1ab_1.conda	Direct	N/A	❌
CVE-2025-12084	Medium	5.3	cpython-3.12.12-py312hd8ed1ab_1.conda	Direct	https://github.com/python/cpython.git - v3.14.1,cpython - 3.13.10,https://github.com/python/cpython.git - v3.13.10,cpython - 3.14.1	❌
CVE-2026-0865	Medium	4.9	cpython-3.12.12-py312hd8ed1ab_1.conda	Direct	N/A	❌
CVE-2025-11468	Medium	4.5	cpython-3.12.12-py312hd8ed1ab_1.conda	Direct	N/A	❌
CVE-2025-12781	Low	3.7	cpython-3.12.12-py312hd8ed1ab_1.conda	Direct	N/A	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2025-15282

Vulnerable Library - cpython-3.12.12-py312hd8ed1ab_1.conda

General purpose programming language

Library home page: https://api.anaconda.org/download/conda-forge/cpython/3.12.12/noarch/cpython-3.12.12-py312hd8ed1ab_1.conda

Path to dependency file: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/cpython-3.12.12-py312hd8ed1ab_1.conda

Dependency Hierarchy:

• ❌ cpython-3.12.12-py312hd8ed1ab_1.conda (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

Publish Date: 2026-01-20

URL: CVE-2025-15282

CVSS 3 Score Details (7.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2026-1299

Vulnerable Library - cpython-3.12.12-py312hd8ed1ab_1.conda

General purpose programming language

Library home page: https://api.anaconda.org/download/conda-forge/cpython/3.12.12/noarch/cpython-3.12.12-py312hd8ed1ab_1.conda

Path to dependency file: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/cpython-3.12.12-py312hd8ed1ab_1.conda

Dependency Hierarchy:

• ❌ cpython-3.12.12-py312hd8ed1ab_1.conda (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

The
email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when
serializing an email message allowing for header injection when an email
is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".

Publish Date: 2026-01-23

URL: CVE-2026-1299

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2026-0672

Vulnerable Library - cpython-3.12.12-py312hd8ed1ab_1.conda

General purpose programming language

Library home page: https://api.anaconda.org/download/conda-forge/cpython/3.12.12/noarch/cpython-3.12.12-py312hd8ed1ab_1.conda

Path to dependency file: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/cpython-3.12.12-py312hd8ed1ab_1.conda

Dependency Hierarchy:

• ❌ cpython-3.12.12-py312hd8ed1ab_1.conda (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

Publish Date: 2026-01-20

URL: CVE-2026-0672

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-15367

Vulnerable Library - cpython-3.12.12-py312hd8ed1ab_1.conda

General purpose programming language

Library home page: https://api.anaconda.org/download/conda-forge/cpython/3.12.12/noarch/cpython-3.12.12-py312hd8ed1ab_1.conda

Path to dependency file: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/cpython-3.12.12-py312hd8ed1ab_1.conda

Dependency Hierarchy:

• ❌ cpython-3.12.12-py312hd8ed1ab_1.conda (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

The poplib module, when passed a user-controlled command, can have
additional commands injected using newlines. Mitigation rejects commands
containing control characters.

Publish Date: 2026-01-20

URL: CVE-2025-15367

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-15366

Vulnerable Library - cpython-3.12.12-py312hd8ed1ab_1.conda

General purpose programming language

Library home page: https://api.anaconda.org/download/conda-forge/cpython/3.12.12/noarch/cpython-3.12.12-py312hd8ed1ab_1.conda

Path to dependency file: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/cpython-3.12.12-py312hd8ed1ab_1.conda

Dependency Hierarchy:

• ❌ cpython-3.12.12-py312hd8ed1ab_1.conda (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Publish Date: 2026-01-20

URL: CVE-2025-15366

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-12084

Vulnerable Library - cpython-3.12.12-py312hd8ed1ab_1.conda

General purpose programming language

Library home page: https://api.anaconda.org/download/conda-forge/cpython/3.12.12/noarch/cpython-3.12.12-py312hd8ed1ab_1.conda

Path to dependency file: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/cpython-3.12.12-py312hd8ed1ab_1.conda

Dependency Hierarchy:

• ❌ cpython-3.12.12-py312hd8ed1ab_1.conda (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

Publish Date: 2025-12-03

URL: CVE-2025-12084

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-12-03

Fix Resolution: https://github.com/python/cpython.git - v3.14.1,cpython - 3.13.10,https://github.com/python/cpython.git - v3.13.10,cpython - 3.14.1

Step up your Open Source Security Game with Mend here

CVE-2026-0865

Vulnerable Library - cpython-3.12.12-py312hd8ed1ab_1.conda

General purpose programming language

Library home page: https://api.anaconda.org/download/conda-forge/cpython/3.12.12/noarch/cpython-3.12.12-py312hd8ed1ab_1.conda

Path to dependency file: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/cpython-3.12.12-py312hd8ed1ab_1.conda

Dependency Hierarchy:

• ❌ cpython-3.12.12-py312hd8ed1ab_1.conda (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

User-controlled header names and values containing newlines can allow injecting HTTP headers.

Publish Date: 2026-01-20

URL: CVE-2026-0865

CVSS 3 Score Details (4.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-11468

Vulnerable Library - cpython-3.12.12-py312hd8ed1ab_1.conda

General purpose programming language

Library home page: https://api.anaconda.org/download/conda-forge/cpython/3.12.12/noarch/cpython-3.12.12-py312hd8ed1ab_1.conda

Path to dependency file: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/cpython-3.12.12-py312hd8ed1ab_1.conda

Dependency Hierarchy:

• ❌ cpython-3.12.12-py312hd8ed1ab_1.conda (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

Publish Date: 2026-01-20

URL: CVE-2025-11468

CVSS 3 Score Details (4.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-12781

Vulnerable Library - cpython-3.12.12-py312hd8ed1ab_1.conda

General purpose programming language

Library home page: https://api.anaconda.org/download/conda-forge/cpython/3.12.12/noarch/cpython-3.12.12-py312hd8ed1ab_1.conda

Path to dependency file: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/cpython-3.12.12-py312hd8ed1ab_1.conda

Dependency Hierarchy:

• ❌ cpython-3.12.12-py312hd8ed1ab_1.conda (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.
This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.
The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64
alphabet they are expecting or verify that their application would not be
affected if the b64decode() functions accepted "+" or "/" outside of altchars.

Publish Date: 2026-01-21

URL: CVE-2025-12781

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

[github-actions]

This issue is stale because it has been open for 30 days with no activity.

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.