PT-2026-23068 · Python+1 · Cpython+1

Zoobaa · Published 2026-03-04 · Updated 2026-05-19 · CVE-2026-2297

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CPython (affected versions not specified)

Description The import hook in CPython that handles legacy *.pyc files using SourcelessFileLoader is incorrectly handled within FileLoader, a base class. This results in the failure to utilize io.open code() when reading these .pyc files. Consequently, sys.audit handlers for the associated audit event do not activate as expected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

ALSA-2026:10950

ALSA-2026:19019

ALSA-2026:19064

ALSA-2026:19176

ALSA-2026:19177

AZL-79413

AZL-79457

AZL-79491

BDU:2026-04596

BIT-LIBPYTHON-2026-2297

BIT-PYTHON-2026-2297

BIT-PYTHON-MIN-2026-2297

CVE-2026-2297

ECHO-1808-4C87-682F

OPENSUSE-SU-2026:10377-1

OPENSUSE-SU-2026:10381-1

OPENSUSE-SU-2026:10394-1

OPENSUSE-SU-2026:10404-1

OPENSUSE-SU-2026:10405-1

OPENSUSE-SU-2026:10522-1

OPENSUSE-SU-2026:20517-1

PSF-2026-9

RHSA-2026:10950

RHSA-2026:19064

RHSA-2026:19177

RHSA-2026:7443

RHSA-2026:7661

RHSA-2026:8822

RHSA-2026:8824

SUSE-SU-2026:0971-1

SUSE-SU-2026:1062-1

SUSE-SU-2026:1107-1

SUSE-SU-2026:1117-1

SUSE-SU-2026:1349-1

SUSE-SU-2026:1354-1

SUSE-SU-2026:20951-1

SUSE-SU-2026:20956-1

SUSE-SU-2026:21104-1

SUSE-SU-2026:21178-1

Affected Products

Cpython

Rocky Linux

References · 133

• https://github.com/python/cpython/pull/145507 · Patch
• https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e · Patch
• https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e · Patch
• https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86 · Patch
• https://github.com/python/cpython/commit/876858c9f65d9ab656c7fa639f268ce7856d89dd · Patch
• https://github.com/python/cpython/commit/69ddd9bb2cc4bd69b1565647c18659c6a789ccd9 · Patch
• https://osv.dev/vulnerability/ALSA-2026:19177 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2297 · Security Note
• https://osv.dev/vulnerability/AZL-79457 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:19176 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-2297 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10405-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:10950 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10377-1 · Vendor Advisory