Group A CPython interpreter CVEs on 3.14 — accepted risk until the next 3.14.x point release

[tyler-rich]

Summary

Scrye's backend runtime is locked to Python 3.14 (CLAUDE.md §2; the 3.13 → 3.14 revision is
logged in docs/ARCHIVE.md §14, 2026-07-25). The runtime image pins
python:3.14-slim-bookworm@sha256:86f975ac…, interpreter 3.14.6 — the current latest 3.14.x.

Three CPython interpreter-binary CVEs are waived in ci/grype.yaml as accepted risk on that
interpreter. All three have their fix merged to the 3.14 maintenance branch but not present
in any released 3.14.x, so all three close on the next 3.14.x point release. This issue is the
tracking reference for that set — it is Group A only; the Group B waiver (CVE-2025-15367,
poplib) is a separate standing acceptance tracked in #52 and is deliberately out of scope here.

These are findings against the CPython interpreter binary itself — not Scrye application code,
Python/JS dependencies, or OS packages.

Updated 2026-07-26: CVE-2025-15366 (imaplib) was added as a third Group A CVE. It was a
Group B entry until the imaplib backport was found on the 3.14 branch — see
Reclassified in from #52 below.

The three CVEs

• CVE-2026-15308 (HIGH) — html.parser.HTMLParser quadratic-complexity CPU-exhaustion DoS.
  An unterminated construct spanning many feed() calls made both the rescan of the growing buffer
  and the concatenation onto it quadratic. Upstream: gh-153030.
• CVE-2026-12003 (MEDIUM) — getpath.py in-tree search-path fallback: the
  %VPATH%/Modules/Setup.local landmark let in-tree (development) sys.path behaviour be enabled
  without modifying the install directory. Upstream: gh-151544.
• CVE-2025-15366 (MEDIUM) — imaplib command injection: IMAP4._command() concatenated
  arguments onto the wire with no CRLF/control-character validation, so newlines in user-controlled
  input could inject additional IMAP commands. Upstream: gh-143921.

Under the dogfood gate (grype --only-fixed --fail-on high) only CVE-2026-15308 trips the
threshold; the other two are reported-but-non-gating Mediums, waived alongside it for a clean
report.

Upstream verification (2026-07-26)

Confirmed at the source, not from scanner metadata or advisory fixed in fields, per
CLAUDE.md § Dependency hygiene (interpreter-CVE source-verification rule). Method: fetch the file
from the 3.14 branch and from the v3.14.6 tag and diff.

CVE-2026-15308 — Lib/html/parser.py

• Merged to 3.14: backport PR python/cpython#153039,
  commit 07efb08, merged 2026-07-04.
• 3.14 branch HTMLParser.feed() buffers incoming data in self._pending and only joins/parses
  once self._parse_threshold is reached (threshold doubles when nothing was parsed), with
  close() flushing the pending list. v3.14.6's feed() is still the unguarded
  self.rawdata = self.rawdata + data; self.goahead(0).
• Fix present on 3.14, absent from v3.14.6.

CVE-2026-12003 — Modules/getpath.py

• Merged to 3.14: backport PR python/cpython#151682,
  commit b93d6d3, merged 2026-06-22 (supersedes the earlier #151565 attempt).
• 3.14 branch removes the BUILD_LANDMARK definitions (Modules/Setup.local on posix/darwin,
  %VPATH%\Modules\Setup.local on nt) and the isfile(joinpath(real_executable_dir, BUILD_LANDMARK)) fallback in the BUILDDIR_TXT handler, replaced by an inline comment citing
  gh-151544; CVE-2026-12003. v3.14.6 still carries both the landmark constants and the
  fallback.
• Fix present on 3.14, absent from v3.14.6.

CVE-2025-15366 — Lib/imaplib.py

• Merged to 3.14: backport PR python/cpython#153137,
  commit 2981822, merged 2026-07-07. Also on 3.13 ([3.13] gh-143921: Reject NUL, CR and LF in IMAP commands (GH-143922, GH-153067) (GH-153137) python/cpython#153287, commit 71926d9).
• 3.14 branch defines _control_chars = re.compile(b'[\x00\r\n]') and raises
  ValueError("NUL, CR and LF not allowed in commands") in IMAP4._command()'s argument loop
  before each argument is appended. v3.14.6 has neither the constant nor the guard.
• The NEWS entry Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst is
  present on 3.14/3.13 and 404s on v3.14.6 — still under next/, confirming it is queued
  for the next point release and has shipped in none.
• Fix present on 3.14, absent from v3.14.6.

Release state

• Include/patchlevel.h on the 3.14 branch reads PY_VERSION "3.14.6+" — post-3.14.6,
  pre-3.14.7.
• No v3.14.7 tag exists and there is no Misc/NEWS.d/3.14.7.rst; 3.14.6 (released
  2026-06-10) is the latest 3.14.x.
• All three backports merged after 3.14.6 shipped, so 3.14.7 is the first release that will
  carry any of them.

Scanner metadata is out of step, as before. Grype's DB reports these as fixed in 3.15.x; it does
not record the maintenance-branch backports. Expect the same lag on the 3.14 line: the waivers may
need to outlive 3.14.7 by a Grype-DB refresh cycle.

Reclassified in from #52 — CVE-2025-15366

CVE-2025-15366 was waived under Group B (a standing acceptance on any interpreter below 3.15) on the
rationale that upstream had declined the backport to 3.10–3.14. The source check above shows that is
no longer the case.

The two Group B CVEs diverged because the original imaplib fix
(python/cpython#143922) rejected all control
characters — the breadth behind the original regression concern — and
python/cpython#153067 then narrowed it to NUL, CR
and LF only. It is the narrowed version that was backported. poplib's fix (CVE-2025-15367) still
rejects the full [\x00-\x1F\x7F] range, has had no equivalent narrowing, and remains
main-only — so it stays a standing acceptance, tracked in #52.

Resolution trigger

All three close on the next 3.14.x point release (3.14.7), once the base-image digest is bumped
to an image carrying it — subject to Grype's DB recognising the 3.14 backports. None requires a 3.15
move, and none is a reason to scope one.

Review date

2026-10-25 — covers the next 1–2 CPython point releases at their ~2-month cadence, plus
Grype-DB refresh lag on the backports.

Waivers

ci/grype.yaml, Group A block:

- vulnerability: CVE-2026-15308   # html.parser quadratic-complexity CPU DoS (HIGH)
- vulnerability: CVE-2026-12003   # getpath.py in-tree search-path fallback (MEDIUM)
- vulnerability: CVE-2025-15366   # imaplib command injection (MEDIUM)

Related

• CVE-2025-15367 (poplib) — accepted risk on any interpreter below 3.15 #52 — re-scoped to CVE-2025-15367 (poplib) only: the Group B standing acceptance, annual
  re-confirmation, next 2027-07-25.
• docs/ARCHIVE.md §14 — 2026-07-13, 2026-07-25, and the two 2026-07-26 entries (Group A
  re-verification; CVE-2025-15366 regrouping).
• CLAUDE.md § Dependency hygiene.

Closing this issue

Closing keywords will not fire on merge. GitHub only auto-closes on a merge into the
repository's default branch, which is main; day-to-day PRs here target dev and reach main
only via a squashed promotion. A Closes #98 in a PR body is therefore inert — close this issue
by hand once 3.14.7 is in the pinned base image and the scan confirms the findings are gone.

[tyler-rich]

Cross-reference: a second Group A set now exists — #116

Three CPython interpreter CVEs in the tarfile stdlib module (CVE-2026-11940, CVE-2026-11972, CVE-2026-0864) were verified on 2026-07-30 and waived in ci/grype.yaml as Group A-2, tracked in #116 (PR #117).

They share this issue's shape and trigger — fix merged to the 3.14 maintenance branch, absent from released v3.14.6, closing on 3.14.7 — and the review dates are deliberately aligned to 2026-10-25 so one review covers both sets.

They are tracked separately on purpose, not by oversight. This issue's verification section is dated 2026-07-26 and covers html.parser / getpath.py / imaplib specifically. Appending CVEs verified on a different date against different files would leave that evidence block not covering half of this issue's own contents, which defeats the point of recording it. So: #98 stays the html.parser / getpath.py / imaplib trio; #116 is the tarfile set. Neither should be folded into the other.

ci/grype.yaml's blocks are now labelled A-1 (#98) / A-2 (#116) / B (#52) with a mapping index at the top of the interpreter section, so which entries belong to which issue is readable from the file itself.

Also worth noting for whoever does the 2026-10-25 review: Grype reported FIXED IN 3.15.0b4 for all three tarfile CVEs and does not record the 3.14 backports — the same pessimistic-direction error already documented here. Expect both sets' waivers to outlive 3.14.7 by a Grype-DB refresh cycle.