← All credits

Seth Larson (https://github.com/sethmlarson)

16 vulnerability records and advisories credit this contributor.

ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity

Use-after-free of a server-side SSLContext when sni_callback switches contexts

CVE-2026-119170

Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

CVE-2026-103995

Lenient parsing of integers for response body and chunk framing

CVE-2026-116566

socket.getaddrinfo() accepts embedded null bytes in host and port

SSLContext.wrap_bio() missing validation of server_hostname parameter

Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

stringprep.map_table_b2() deviates from RFC 3454 Table B.2

Configuration Injection via Carriage Return (\r) in write() method

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations