CVE-2026-3298
High
Description
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
SeverityHigh
CVSS8.8
Exploit probability—
ProductCPython
PublishedApr 21, 2026
First seenApr 21, 2026
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- Python Software Foundation CPython3.11.16, 3.12.14, 3.13.14, 3.14.5rc1, 3.15.0b1 or later
Patches
- github.com/python/cpython/pull/148809
- github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d
- github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2
- github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741
- github.com/python/cpython/commit/6c8b85b3f1d83d5697ec19880960e1eacee56688
- github.com/python/cpython/commit/f5ca38739241fe7a40a4b116d5a8a1364dd6fea7
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation CPython | v < 3.11.16, 3.12.0 ≤ v < 3.12.14, 3.13.0 ≤ v < 3.13.14, 3.14.0a1 ≤ v < 3.14.5rc1, 3.15.0a1 ≤ v < 3.15.0b1 | 3.11.16, 3.12.14, 3.13.14, 3.14.5rc1, 3.15.0b1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.