Vulnerability · Published May 13, 2026 · Assigned by PSF
CVE-2026-8328FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
Medium 5.9
In plain English
A medium-severity server-side request forgery in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | python3 | 3.14.7-r0 | ALPINE-CVE-2026-8328 |
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2026-8328 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-8328 |
| Debian:14 | pypy3 | 8.0.0+dfsg-1 | DEBIAN-CVE-2026-8328 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u9 | DEBIAN-CVE-2026-8328 |
| Debian:13 | python3.13 | 3.13.5-2+deb13u3 | DEBIAN-CVE-2026-8328 |
| Debian:14 | python3.14 | 3.14.6-1 | DEBIAN-CVE-2026-8328 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.16 | UBUNTU-CVE-2026-8328 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.16 | USN-8509-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 | USN-8509-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 | UBUNTU-CVE-2026-8328 |
| Ubuntu:25.10 | python3.13 | no fix listed | UBUNTU-CVE-2026-8328 |
| Ubuntu:25.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-8328 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.1 | USN-8509-1 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.1 | UBUNTU-CVE-2026-8328 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.213.11.0 – before 3.11.163.12.0 – before 3.12.143.13.0 – before 3.13.143.14.0 – before 3.14.63.15.0a1 – before 3.15.0b2 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/issues/87451 issue-tracking
- https://github.com/python/cpython/pull/149648 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/ vendor-advisory
- https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06 patch
- https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0 patch
- https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763 patch
- https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d patch
- https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9 patch
- https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f patch
- https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb patch