6.1
Medium
CVE-2023-6507 An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms
Description
An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).
Affected products and versions
Other CVEs of CPython
The 80 CVEs of CPython →
CVE-2026-119170
Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10
8.2
High
CVE-2026-116566
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be…
5.3
Medium
CVE-2026-103995
Lenient parsing of integers for response body and chunk framing
2.0
Low
CVE-2026-115557
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without…
9.4
Critical