DLA-4354-1

CVE-2025-0938 CVE-2025-1795 CVE-2025-6069 CVE-2025-8291

This upload fixes a few of security issues in the Python standard library included with PyPy, an alternative implementation of the Python 3 language.

CVE-2024-6232

The tarfile module used to parse tar parsed header values with regular
expressions that allowed for backtracking, which could be used to cause
denial of service via specifically-crafted tar archives (ReDoS). Since
tar headers have a well-known format that doesn't require backtracking
to parse reliably, the new method of parsing only requires a single pass
over a byte stream.

CVE-2024-6923

The email module didn&#x2019;t properly quote newlines when serialising
email messages, which could be used to inject newlines that would
affect the interpretation of the email headers. An attacker could
cause some email headers to be completely skipped or potentially
hide malicious headers within other headers.

CVE-2024-7592

The http.cookies, when parsing cookies that contained backslashes
for quoted characters in the cookie value, would use an algorithm
with quadratic complexity, resulting in excess CPU resources being
used while parsing the value. E.g. parsing a 20000+ byte cookie
would take about a second (ReDoS).

CVE-2024-11168 and CVE-2025-0938

The urllib.parse.urlsplit and urlparse functions improperly validated
domain names that included square brackets allowing hosts that
weren't IPv6 or IPvFuture.

CVE-2025-1795

In the email module, during an address list folding, when a separating
comma ended up on a folded line and that line is to be Unicode-encoded,
then the separator itself was also Unicode-encoded. Expected behavior
is that the separating comma remains a plan comma. This could result
in the address header being misinterpreted by some mail servers.

CVE-2025-6069

The html.parser.HTMLParser class had worse-case quadratic complexity
when...