medium 5.3

CVE-2026-5713 json

Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

published 2026-04-14 6 mo ago modified 2026-10-26 13 d ago also BIT-libpython-2026-5713 , BIT-python-2026-5713 , BIT-python-min-2026-5713 , EUVD-2026-22311

cvss: 5.3; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits: 0; none known

The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.

Patch / fix

fixed in 4 distros 6 links 3

bitnami libpython 3.14.5
bitnami python 3.14.5
bitnami python-min 3.14.5
Python Software Foundation CPython 3.14.5, 3.15.0b1

debian ubuntu red hat opensuse almalinux rocky linux

python3.14 Debian 14 3.14.5-1

debian advisories DEBIAN-CVE-2026-5713

python3.14 Ubuntu 26.04 LTS 3.14.4-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2026-5713

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python3.14 RHEL 9 3.14.4-2.el9_8
python3.14-idle RHEL 9 3.14.4-2.el9_8
python3.14-libs RHEL 9 3.14.4-2.el9_8
python3.14-test RHEL 9 3.14.4-2.el9_8
python3.14-tkinter RHEL 9 3.14.4-2.el9_8
python3.14-freethreading RHEL 9 3.14.4-2.el9_8
python3.14-freethreading-idle RHEL 9 3.14.4-2.el9_8
python3.14-freethreading-libs RHEL 9 3.14.4-2.el9_8

red hat advisories RHSA-2026:19176 RHSA-2026:19019 RHSA-2026:9228 RHSA-2026:8822 RHSA-2026:8824 RHSA-2026:7443

python314 openSUSE Tumbleweed 3.14.6-1.1
python315 openSUSE Tumbleweed 3.15.0~a8-3.1

opensuse advisories openSUSE-SU-2026:11181-1 openSUSE-SU-2026:10648-1

python3.14 AlmaLinux 10 3.14.4-2.el10_2
python3.14-idle AlmaLinux 10 3.14.4-2.el10_2
python3.14-libs AlmaLinux 10 3.14.4-2.el10_2
python3.14-test AlmaLinux 10 3.14.4-2.el10_2
python3.14-tkinter AlmaLinux 10 3.14.4-2.el10_2
python3.14-freethreading AlmaLinux 10 3.14.4-2.el10_2
python3.14-freethreading-idle AlmaLinux 10 3.14.4-2.el10_2
python3.14-freethreading-libs AlmaLinux 10 3.14.4-2.el10_2

almalinux advisories ALSA-2026:19019 ALSA-2026:19176

python3.14 Rocky Linux 9 3.14.4-2.el9_8
python3.14 Rocky Linux 10 3.14.4-2.el10_2

rocky linux advisories RLSA-2026:19176 RLSA-2026:19019

github.com/python/cpython@289fd2c commit
github.com/python/cpython@316f626 commit
github.com/python/cpython#148187 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-5713 updated 2026-11-06 cvss 6.0

python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process.

Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, python3, tkinter, python-libs, python-test, python-tools, +4 more Red Hat Enterprise Linux 8 pytz, babel, numpy, scipy, Cython, PyYAML, +139 more Red Hat Enterprise Linux 9 python3, python3.9, python3.11, python3.12, python3-idle, python3-libs, +11 more Red Hat Enterprise Linux 10 python3.12 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/bootc-azure-cuda-rhel9, rhelai3/bootc-azure-rocm-rhel9
affected: workaround, no fix available “Fix deferred”
Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel9
under investigation
Red Hat Enterprise Linux AppStream (v. 9) python3.14 3.14.4-2.el9_8, python3.14-libs 3.14.4-2.el9_8, python3.14-tkinter 3.14.4-2.el9_8
fixed: vendor fix RHSA-2026:19176
Red Hat Enterprise Linux AppStream (v. 10) python3.14 3.14.4-2.el10_2, python3.14-libs 3.14.4-2.el10_2, python3.14-tkinter 3.14.4-2.el10_2
fixed: vendor fix RHSA-2026:19019
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.14 3.14.4-2.el9_8, python3.14-idle 3.14.4-2.el9_8, python3.14-test 3.14.4-2.el9_8, python3.14-tkinter 3.14.4-2.el9_8, python3.14-freethreading 3.14.4-2.el9_8, python3.14-freethreading-idle 3.14.4-2.el9_8, +3 more
fixed: vendor fix RHSA-2026:19176
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3.14-idle 3.14.4-2.el10_2, python3.14-test 3.14.4-2.el10_2, python3.14-freethreading 3.14.4-2.el10_2, python3.14-freethreading-idle 3.14.4-2.el10_2, python3.14-freethreading-libs 3.14.4-2.el10_2, python3.14-freethreading-test 3.14.4-2.el10_2, +1 more
fixed: vendor fix RHSA-2026:19019
Red Hat Hardened Images python3 3.14.4-2.hum1, python3.14 3.14.4-2.hum1, python3.11 3.11.15-4.hum1, python3.12 3.12.13-3.hum1, python3.13 3.13.13-1.hum1, python3-idle 3.14.4-2.hum1, +22 more
fixed: vendor fix RHSA-2026:9228

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 6 mo ago (2026-04-14)

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA	4.0	5.3	CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
bitnami	libpython	>=3.14.0, <3.14.5	3.14.5
bitnami	python	>=3.14.0, <3.14.5	3.14.5
bitnami	python-min	>=3.14.0, <3.14.5	3.14.5

Affected products

Python Software Foundation CPython

Classification

Weakness

CWE-121 Stack-based Buffer Overflow
CWE-125 Out-of-bounds Read

References

github.com /python/cpython/pull/148187
patch, web
github.com /python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67
patch, web
github.com /python/cpython/commit/316f6265b7f9ca4ffed5346b747475ef1943f35d
patch, web
mail.python.org /archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/
vendor-advisory, web
github.com /python/cpython/issues/148178
issue-tracking, web
openwall.com /lists/oss-security/2026/04/15/6
web
nvd.nist.gov /vuln/detail/CVE-2026-5713
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary