QwikSec

Security Database

CVE

CWE

Training

CVE-2026-3298

Published: Apr 21, 2026

Modified: May 12, 2026

PUBLISHED

Description

The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.

Vendor	Product	Versions
Python Software Foundation	CPython	affected `3.11.0 - < 3.14.5rc1` affected `3.15.0a1 - < 3.15.0b1`

Weaknesses (CWE)

References

https://github.com/python/cpython/pull/148809

patch

https://github.com/python/cpython/issues/148808

issue-tracking

https://mail.python.org/archives/list/[email protected]/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/

vendor-advisory

https://github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d

patch

https://github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2

patch

https://github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741

patch

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.