Skip to content

CVE-2026-3298 on CTRL-OS 26.05

Aliases: CVE-2026-3298

Packages: python313

Status: Plausible, Resolved

Advisory Information

The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.

Updates

2026-07-21 16:58 CEST

Metadata changes:

  • Status for package python313: “Resolved” (fff38d56fb8e15a140da141149c596766b838d0b)

2026-07-21 16:58 CEST

Metadata changes:

  • Status for package python314: “Resolved” (8720e26a455838194d661c3d1e8e9f0c2de4ba94)

2026-07-21 16:58 CEST

Metadata changes:

  • Status for package python315: “Resolved” (de92bac9084b9249b02934240202bf9d74a3a9c3)

2026-07-21 16:57 CEST

Metadata changes:

  • Status for package python311: “Plausible”
  • Status for package python312: “Plausible”
  • Status for package python313: “Plausible”
  • Status for package python314: “Plausible”
  • Status for package python315: “Plausible”

2026-06-04 00:03 CEST

Metadata changes:

  • Status for package python311: “New”
  • Status for package python312: “New”
  • Status for package python313: “New”
  • Status for package python314: “New”
  • Status for package python315: “New”

(Amended on: 2026-06-04 00:05 CEST)