CVE-2019-19275

typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)

• CWE-125

• https://bugs.python.org/issue36495Patch, Vendor Advisory
• https://github.com/python/cpython/commit/a4d78362397fc3bced6ea80fbc7b5f4827aec55ePatch, Third Party Advisory
• https://github.com/python/cpython/commit/dcfcd146f8e6fc5c2fc16a4c192a0c5f5ca8c53cPatch, Third Party Advisory
• https://github.com/python/typed_ast/commit/156afcb26c198e162504a57caddfe0acd9ed7dcePatch, Third Party Advisory
• https://github.com/python/typed_ast/commit/dc317ac9cff859aa84eeabe03fb5004982545b3bPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LG5H4Q6LFVRX7SFXLBEJMNQFI4T5SCEA/
• https://bugs.python.org/issue36495Patch, Vendor Advisory
• https://github.com/python/cpython/commit/a4d78362397fc3bced6ea80fbc7b5f4827aec55ePatch, Third Party Advisory
• https://github.com/python/cpython/commit/dcfcd146f8e6fc5c2fc16a4c192a0c5f5ca8c53cPatch, Third Party Advisory
• https://github.com/python/typed_ast/commit/156afcb26c198e162504a57caddfe0acd9ed7dcePatch, Third Party Advisory
• https://github.com/python/typed_ast/commit/dc317ac9cff859aa84eeabe03fb5004982545b3bPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LG5H4Q6LFVRX7SFXLBEJMNQFI4T5SCEA/

Published

Nov 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1927Multiple vulnerabilities in Cisco Webex Network Recording Pl…7.8
• CVE-2019-19270An issue was discovered in tls_verify_crl in ProFTPD through…7.5
• CVE-2019-19271An issue was discovered in tls_verify_crl in ProFTPD before …7.5
• CVE-2019-19272An issue was discovered in tls_verify_crl in ProFTPD before …7.5
• CVE-2019-19273On Samsung mobile devices with O(8.0) and P(9.0) software an…7.8
• CVE-2019-19274typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-…7.5
• CVE-2019-19276A vulnerability has been identified in SIMATIC HMI Comfort P…5.3
• CVE-2019-19277A vulnerability has been identified in SIPORT MP (All versio…6.5
• CVE-2019-19278A vulnerability has been identified in SINAMICS PERFECT HARM…6.8
• CVE-2019-19279A vulnerability has been identified in SIPROTEC 4 and SIPROT…7.5
• CVE-2019-1928Multiple vulnerabilities in Cisco Webex Network Recording Pl…7.8
• CVE-2019-19281A vulnerability has been identified in SIMATIC ET 200SP Open…7.5