Repository navigation

2.7.18.16 Release: 17 security fixes, bundled Expat 2.9.0 - #113

Merged

icanhasmath merged 43 commits into

2.7from

2.7.18.16

Oct 28, 2026

Merged

2.7.18.16 Release: 17 security fixes, bundled Expat 2.9.0#113
icanhasmath merged 43 commits into
2.7from
2.7.18.16

Commits on Oct 28, 2026
- gh-151981: Make tarfile._Stream.seek break at EOF (CVE-2026-11972)
  
  icanhasmath
  and
  claude
  committed
  337d3dd
- gh-98820: Fix quadratic time in csv.Sniffer for quoted fields (CVE-2026-18503)
  
  icanhasmath
  and
  claude
  committed
  b54342d
- gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (CVE-2026-8328)
  
  icanhasmath
  and
  claude
  committed
  0f0b14a
- gh-150751: validate httplib Content-Length and chunk-size (CVE-2026-103995)
  
  icanhasmath
  and
  claude
  committed
  2f517c3
- bpo-44022: limit the headers skipped after a 100 Continue (CVE-2021-3737)
  
  icanhasmath
  and
  claude
  committed
  27175c6
- gh-87389: Fix an open redirect vulnerability in SimpleHTTPServer (CVE-2021-28861)
  
  icanhasmath
  and
  claude
  committed
  3b8050a
- gh-159428: Don't read mimetypes.knownfiles by default on Windows (CVE-2024-3220)
  
  icanhasmath
  and
  claude
  committed
  5bd9f30
- gh-145986: Avoid unbounded C recursion in pyexpat conv_content_model (CVE-2026-4224)
  
  icanhasmath
  and
  claude
  committed
  2109f04
- gh-150599: Prevent bz2 decompressor reuse after errors (CVE-2026-9669)
  
  icanhasmath
  and
  claude
  committed
  ec2f6f5
- gh-152674: Avoid quadratic behavior in ElementPath index predicates (CVE-2026-6879)
  
  icanhasmath
  and
  claude
  committed
  97b9b4b
- gh-155694: Scope HTTPPasswordMgr credentials by URL scheme (CVE-2026-15806)
  
  icanhasmath
  and
  claude
  committed
  bb28a49
- gh-153030: Fix quadratic complexity in incremental HTMLParser feeding (CVE-2026-15308)
  
  icanhasmath
  and
  claude
  committed
  a5889ec
- gh-158876: Update bundled Expat to 2.9.0
  
  icanhasmath
  and
  claude
  committed
  9872782
- gh-156293: Do not call the SNI callback through a released SSLContext (CVE-2026-19445)
  
  icanhasmath
  and
  claude
  committed
  7840229
- gh-149079: Fix O(n^2) canonical ordering in unicodedata.normalize() (CVE-2026-3276)
  
  icanhasmath
  and
  claude
  committed
  4ea11bd
- gh-118486: Support mkdir(mode=0700) on Windows (CVE-2024-4030)
  
  icanhasmath
  and
  claude
  committed
  386508c
- Define XML_POOR_ENTROPY for the Windows _elementtree build
  
  icanhasmath
  and
  claude
  committed
  403699f
- gh-149018: Give Expat parsers a 16-byte random hash salt (CVE-2026-7210)
  
  icanhasmath
  and
  claude
  committed
  fb66720
- bz2: Make BZ2File unusable for reading after a data error (CVE-2026-9669)
  
  icanhasmath
  and
  claude
  committed
  47fbde7
- gh-150743: Limit trailer lines and interim responses read by httplib
  
  icanhasmath
  and
  claude
  committed
  eb736f0
- Merge pull request #104 from ActiveState/2.7.18.16-expat-2.9.0
  icanhasmath
  authored
  bbc25c2
- Merge pull request #105 from ActiveState/2.7.18.16-expat-hash-salt
  icanhasmath
  authored
  834ab93
- Merge pull request #92 from ActiveState/2.7.18.16-tarfile-stream-eof
  icanhasmath
  authored
  9ce1f67
- Merge pull request #93 from ActiveState/2.7.18.16-csv-sniffer
  icanhasmath
  authored
  f45cff7
- Merge pull request #94 from ActiveState/2.7.18.16-ftpcp-pasv
  icanhasmath
  authored
  0ebf594
- Merge pull request #95 from ActiveState/2.7.18.16-httplib-length-chunk
  icanhasmath
  authored
  d41211d
- Merge pull request #96 from ActiveState/2.7.18.16-httplib-100-continue
  icanhasmath
  authored
  2c8fcb0
- Merge pull request #97 from ActiveState/2.7.18.16-httpserver-open-redirect
  icanhasmath
  authored
  15b20d0
- Merge pull request #98 from ActiveState/2.7.18.16-mimetypes-knownfiles
  icanhasmath
  authored
  a3e15cc
- Merge 2.7.18.16 into 2.7.18.16-pyexpat-content-model
  icanhasmath
  committed
  7d13ea2
- Merge pull request #99 from ActiveState/2.7.18.16-pyexpat-content-model
  icanhasmath
  authored
  b71f7f0
- Merge pull request #100 from ActiveState/2.7.18.16-bz2-decomp-reuse
  icanhasmath
  authored
  75220b8
- Merge pull request #101 from ActiveState/2.7.18.16-elementpath-index
  icanhasmath
  authored
  dbf42d7
- Merge pull request #102 from ActiveState/2.7.18.16-urllib2-passwordmgr-scheme
  icanhasmath
  authored
  60efc04
- Merge pull request #103 from ActiveState/2.7.18.16-htmlparser-incremental
  icanhasmath
  authored
  8aefbbf
- Merge pull request #106 from ActiveState/2.7.18.16-ssl-sni-uaf
  icanhasmath
  authored
  6345061
- Merge pull request #107 from ActiveState/2.7.18.16-unicodedata-normalize
  icanhasmath
  authored
  4e0ddee
- Merge pull request #108 from ActiveState/2.7.18.16-win-mkdir-700
  icanhasmath
  authored
  2f2ab99
- Merge 2.7 (2.7.18.15, #91) into 2.7.18.16
  icanhasmath
  committed
  2ce4529
- Review follow-ups for 2.7.18.16: _socket debug link, SNI None ref, sddl.h
  
  icanhasmath
  and
  claude
  committed
  85ba67c
- test_ssl: drop the third-party mock import
  
  icanhasmath
  and
  claude
  committed
  b9b77db
- Merge pull request #111 from ActiveState/2.7.18.16-review-followups
  icanhasmath
  authored
  0471d8e
- 2.7.18.16 Release
  
  icanhasmath
  and
  claude
  committed
  60c3e21

Commits

Commits on Oct 28, 2026