debian/python-rply vulnerabilities

Latest debian/python-rply CVEs

Newest publication first

1. CVE-2026-115722 RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header

   Published 2026-10-23

   Medium·CVSS 6.9 EPSS 0.13%

   RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crash...

2. CVE-2014-1938 Link Following in rply

   Published 2019-11-21

   Medium·CVSS 5.5 EPSS 0.39%

   python-rply before 0.7.4 insecurely creates temporary files.

3. CVE-2014-1604 RPLY Predictable Tmpfile Names Allows Cache Spoofing

   Published 2014-01-28

   Low·CVSS 2.1 EPSS 0.35%

   The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.