gef

Version: 2026.01

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

Install package

min add gef

Toolbinary-ninjactfdebugging

Updated 2 months ago

OpenSSF Score

Last scored on 2026-10-05

What is "gef"?

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

How to use this package

Quick install

Installs the package into the current environment for this session. Use --build or --runtime to persist it as a build-time or runtime dependency.

min add gef

Declare as a task dependency in minimal.toml

Listing the package under tasks.<name>.packages makes it available inside that task’s sandbox.

[tasks.dev]
packages = ["gef"]

Build-time vs runtime

Choose build-time for tools needed during compilation, runtime for dynamic libraries loaded at runtime.

min add --build gef
min add --runtime gef

Dependencies (4)

Dependencies
Name	Version	Kind
base	—	build
bash	5.3	runtime
gdb	17.2	runtime
python CVE:9	3.14.7	runtime

Dependency changes

No dependants

No other packages in the registry depend on this one.

gef v2026.013ccfc4f
Diff
Lines:+117Deps:4(+4)
Released: 2 months ago

No direct advisories

This package inherits 22 transitive advisories from its dependencies.

Include transitive

Showing 22 transitive advisories via gef's dependencies

Security advisories for this package
	Status	IDs	Package	Version	Severity	Published
Critical (1)
	Under investigation	PSF-2026-43 CVE-2026-19445	python	3.14.5 – 3.14.7	Critical	7 days ago
Summary Use-after-free of a server-side SSLContext when sni_callback switches contexts Via python Affected ranges 3.14.5 – 3.14.7 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19445.json, https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/, https://nvd.nist.gov/vuln/detail/CVE-2026-19445 Fix: https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d, https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b, https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7, https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8, https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698 +3 more Report: https://github.com/python/cpython/issues/156293 Web: http://www.openwall.com/lists/oss-security/2026/09/30/17 PACKAGE: https://github.com/python/cpython
High (5)
	Status	IDs	Package	Version	Severity	Published
	Under investigation	PSF-2026-44 CVE-2026-19553	python	3.14.5 – 3.14.7	High	7 days ago
Summary SSLContext.wrap_bio() missing validation of server_hostname parameter Via python Affected ranges 3.14.5 – 3.14.7 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19553.json, https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/, https://nvd.nist.gov/vuln/detail/CVE-2026-19553 Fix: https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96, https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf, https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082, https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed, https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced +3 more Report: https://github.com/python/cpython/issues/156793 Web: http://www.openwall.com/lists/oss-security/2026/09/30/16 PACKAGE: https://github.com/python/cpython
	Affected: 3.6.4	CVE-2026-84784	openssl	3.6.0 – 3.6.4	High: 7.5	8 days ago
Summary QUIC: Unbounded RETIRE_CONNECTION_ID Backlog Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84784.json, https://nvd.nist.gov/vuln/detail/CVE-2026-84784, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/4685c914b0d410b1034f40b547c95bc95e7a380a, https://github.com/openssl/openssl/commit/9a30fe0fba195c14e5b87bf93c0d0fdb70373806, https://github.com/openssl/openssl/commit/dba3c48d653c64fcbc9070a17a0ee2b3e2f3af1f, https://github.com/openssl/openssl/commit/e9e5155833fa968bee50024bf9ca3a185ab599fe
	Affected: 3.6.4	CVE-2026-84782	openssl	3.6.0 – 3.6.4	High: 8.2	8 days ago
Summary DTLS Retransmits Handshake Messages From a Stale Buffer Offset Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84782.json, https://nvd.nist.gov/vuln/detail/CVE-2026-84782, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943, https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628, https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58, https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c
	Affected: 3.6.4	CVE-2026-72897	openssl	3.6.0 – 3.6.4	High: 7.5	8 days ago
Summary Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72897.json, https://nvd.nist.gov/vuln/detail/CVE-2026-72897, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922, https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e, https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61, https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814
	Affected: 3.6.4	CVE-2026-54873	openssl	3.6.0 – 3.6.4	High: 7.5	8 days ago
Summary QUIC STREAM Fragment Metadata DoS Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54873.json, https://nvd.nist.gov/vuln/detail/CVE-2026-54873, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23, https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53, https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb, https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2
Medium (11)
	Status	IDs	Package	Version	Severity	Published
	Affected: 3.14.7	PSF-2026-42 CVE-2026-12345	python	3.14.7	Medium	8 days ago
Summary Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory Via python Affected ranges 3.14.7 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12345.json, https://nvd.nist.gov/vuln/detail/CVE-2026-12345 Fix: https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970, https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420, https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d, https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993, https://github.com/python/cpython/pull/157580 Report: https://github.com/python/cpython/issues/157579 Web: http://www.openwall.com/lists/oss-security/2026/09/29/40 PACKAGE: https://github.com/python/cpython
	Affected: 3.6.4	CVE-2026-75806	openssl	3.6.0 – 3.6.4	Medium: 5.3	8 days ago
Summary Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75806.json, https://nvd.nist.gov/vuln/detail/CVE-2026-75806, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d, https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972, https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d, https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d
	Affected: 3.6.4	CVE-2026-75805	openssl	3.6.0 – 3.6.4	Medium: 5.3	8 days ago
Summary NULL Pointer Dereference in CMP Client Revocation Response Handling Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75805.json, https://nvd.nist.gov/vuln/detail/CVE-2026-75805, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166, https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7, https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3, https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f
	Affected: 3.6.4	CVE-2026-75804	openssl	3.6.0 – 3.6.4	Medium: 5.3	8 days ago
Summary QUIC Connection-Level Flow Control is Not Enforced for Streams Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75804.json, https://nvd.nist.gov/vuln/detail/CVE-2026-75804, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e, https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538, https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a, https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03
	Affected: 3.6.4	CVE-2026-42772	openssl	3.6.0 – 3.6.4	Medium: 5.3	8 days ago
Summary Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42772.json, https://nvd.nist.gov/vuln/detail/CVE-2026-42772, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09, https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e, https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773, https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a
	Affected: 3.6.4	CVE-2026-35189	openssl	3.6.0 – 3.6.4	Medium: 5.3	8 days ago
Summary Excessive Memory Allocation in Relative CRLDP Processing Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35189.json, https://nvd.nist.gov/vuln/detail/CVE-2026-35189, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84, https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89, https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f, https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9
	Under investigation	BIT-libpython-2026-87910 BIT-python-2026-87910 BIT-python-min-2026-87910 PSF-2026-40 CVE-2026-87910	python	3.14.5 – 3.14.7	Medium	26 days ago
Summary tarfile hardlink fallback ignores custom extraction filter rejection via None Via python Affected ranges 3.14.5 – 3.14.7 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87910.json, https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/, https://nvd.nist.gov/vuln/detail/CVE-2026-87910 Fix: https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f, https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5, https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036, https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955, https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0 +4 more Report: https://github.com/python/cpython/issues/157265 Web: http://www.openwall.com/lists/oss-security/2026/09/11/8 PACKAGE: https://github.com/python/cpython
	Under investigation	CVE-2026-19672	python	3.14.5 – 3.14.7	Medium	2 months ago
Summary The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created. Via python Affected ranges 3.14.5 – 3.14.7
	Under investigation	BIT-libpython-2026-15806 BIT-python-2026-15806 BIT-python-min-2026-15806 PSF-2026-36 CVE-2026-15806	python	3.14.5 – 3.14.7	Medium	2 months ago
Summary `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching Via python Affected ranges 3.14.5 – 3.14.7 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15806.json, https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/, https://nvd.nist.gov/vuln/detail/CVE-2026-15806 Fix: https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6, https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc, https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801, https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8, https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce +3 more Report: https://github.com/python/cpython/issues/155694 Web: http://www.openwall.com/lists/oss-security/2026/08/18/3 PACKAGE: https://github.com/python/cpython
	Under investigation	BIT-libpython-2026-17084 BIT-python-2026-17084 BIT-python-min-2026-17084 PSF-2026-37 CVE-2026-17084	python	3.14.5 – 3.14.7	Medium	2 months ago
Summary stringprep.map_table_b2() deviates from RFC 3454 Table B.2 Via python Affected ranges 3.14.5 – 3.14.7 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17084.json, https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/, https://nvd.nist.gov/vuln/detail/CVE-2026-17084 Fix: https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae, https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7, https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296, https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc, https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214 +4 more Report: https://github.com/python/cpython/issues/155292 Web: http://www.openwall.com/lists/oss-security/2026/08/18/2 PACKAGE: https://github.com/python/cpython
	Under investigation	BIT-libpython-2025-15367 BIT-python-2025-15367 BIT-python-min-2025-15367 PSF-2026-4 CVE-2025-15367	python	3.14.5 – 3.14.7	Medium	9 months ago
Summary POP3 command injection in user-controlled commands Via python Affected ranges 3.14.5 – 3.14.7 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15367.json, https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/, https://nvd.nist.gov/vuln/detail/CVE-2025-15367 Fix: https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7, https://github.com/python/cpython/pull/143924 Report: https://github.com/python/cpython/issues/143923 PACKAGE: https://github.com/python/cpython
Low (5)
	Status	IDs	Package	Version	Severity	Published
	Affected: 3.6.4	CVE-2026-77696	openssl	3.6.0 – 3.6.4	Low: 3.7	8 days ago
Summary Timing Side-Channel in SM2 Signature Generation Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77696.json, https://nvd.nist.gov/vuln/detail/CVE-2026-77696, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9, https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb, https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64, https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440
	Affected: 3.6.4	CVE-2026-54875	openssl	3.6.0 – 3.6.4	Low: 3.7	8 days ago
Summary Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54875.json, https://nvd.nist.gov/vuln/detail/CVE-2026-54875, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257, https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8, https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28, https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c
	Affected: 3.6.4	CVE-2026-54872	openssl	3.6.0 – 3.6.4	Low: 3.7	8 days ago
Summary Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54872.json, https://nvd.nist.gov/vuln/detail/CVE-2026-54872, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179, https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb, https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd, https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471
	Affected: 3.6.4	CVE-2026-35191	openssl	3.6.0 – 3.6.4	Low: 3.7	8 days ago
Summary QUIC Unvalidated Amplification Credit may be Over Accounted Via python openssl Affected ranges 3.6.0 – 3.6.4 CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35191.json, https://nvd.nist.gov/vuln/detail/CVE-2026-35191, https://openssl-library.org/news/secadv/20260929.txt Fix: https://github.com/openssl/openssl/commit/0fe4442d4f8ea3af8a174046dae176e0d4717239, https://github.com/openssl/openssl/commit/2de4c35fb13fc58f43fd8dc1d261700472ce72e5, https://github.com/openssl/openssl/commit/e44292e58b090014232ef75bd400393851b24d1a
	Under investigation	BIT-libpython-2026-15310 BIT-python-2026-15310 BIT-python-min-2026-15310 PSF-2026-39 CVE-2026-15310	python	3.14.5 – 3.14.7	Low	last month
Summary zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits Via python Affected ranges 3.14.5 – 3.14.7 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15310.json, https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/, https://nvd.nist.gov/vuln/detail/CVE-2026-15310 Fix: https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2, https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8, https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89, https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530, https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70 +6 more Report: https://github.com/python/cpython/issues/156002 PACKAGE: https://github.com/python/cpython
Unknown (0)
	Status	IDs	Package	Version	Severity	Published

Build provenance

For the signed record of what the build used, see the Provenance tab.

47 components

Software Bill of Materials — every package this build depends on
Packages	Version	Repository	License
gefROOT	2026.01	github.com/hugsy/gef	MIT
acl	2.4.0	https://storage.googleapis.com/minimal-staging-archives/acl-2.4.0.tar.xzMIRROR	(GPL-2.0-only AND LGPL-2.1-only)
attr	2.6.0	https://storage.googleapis.com/minimal-staging-archives/attr-2.6.0.tar.gzMIRROR	(GPL-2.0-only AND LGPL-2.1-only)
bash	5.3	www.gnu.org/software/bash	GPL-3.0-only
bash-bootstrap	5.3	www.gnu.org/software/bash	GPL-3.0-only
binutils	2.47	www.gnu.org/software/binutils	(GPL-2.0-only AND GPL-3.0-only AND LGPL-2.0-only)
bison	3.8.2	www.gnu.org/software/bison	GPL-3.0-only
bzip2	1.0.8	github.com/libarchive/bzip2	bzip2-1.0.6
coreutils	9.12	www.gnu.org/software/coreutils	GPL-3.0-only
diffutils	3.12	www.gnu.org/software/diffutils	GPL-3.0-only
expat	2.8.5	github.com/libexpat/libexpat	MIT
file	5.48	https://storage.googleapis.com/minimal-staging-archives/file-5.48.tar.gzMIRROR	BSD-2-Clause-Darwin
findutils	4.11.0	www.gnu.org/software/findutils	GPL-3.0-only
flex	2.6.4	github.com/westes/flex	BSD-3-Clause-flex
gawk	5.4.1	www.gnu.org/software/gawk	GPL-3.0-only
gawk-bootstrap	5.4.1	www.gnu.org/software/gawk	GPL-3.0-only
gcc	15.2.0	www.gnu.org/software/gcc	(GPL-2.0-only AND GPL-3.0-only AND LGPL-2.1-only)
gdb	17.2	www.gnu.org/software/gdb	GPL-3.0-or-later
gdbm	1.26	www.gnu.org/software/gdbm	GPL-3.0-only
glibc	2.44	www.gnu.org/software/glibc	(GPL-2.0-only AND LGPL-2.1-only)
gmp	6.3.0	www.gnu.org/software/gmp	LGPL-3.0-or-later OR GPL-2.0-or-later
grep	3.12	www.gnu.org/software/grep	GPL-3.0-only
gzip	1.15	www.gnu.org/software/gzip	GPL-3.0-only
libcap	2.78	https://storage.googleapis.com/minimal-staging-archives/libcap-2.78.tar.xzMIRROR	BSD-3-Clause OR GPL-2.0-only
libffi	3.8.0	github.com/libffi/libffi	MIT
linux_headers	6.12.43	github.com/torvalds/linux	GPL-2.0-only WITH Linux-syscall-note
lz4	1.10.0	github.com/lz4/lz4	BSD-2-Clause AND GPL-2.0-or-later
m4	1.4.21	www.gnu.org/software/m4	GPL-3.0-only
make	4.4.1	www.gnu.org/software/make	GPL-3.0-only
mpc	1.4.1	www.gnu.org/software/mpc	LGPL-3.0-or-later
mpfr	4.2.2	www.gnu.org/software/mpfr	GPL-3.0-only
ncurses	6.6	www.gnu.org/software/ncurses	X11-distribute-modifications-variant
openssl	3.6.4	github.com/openssl/openssl	Apache-2.0
patch	2.8	www.gnu.org/software/patch	GPL-3.0-only
pcre2	10.49	github.com/PCRE2Project/pcre2	BSD-3-Clause WITH PCRE2-exception
perl	5.44.0	github.com/Perl/perl5	Artistic-1.0-Perl OR GPL-1.0-or-later
pkgconf	3.0.5	github.com/pkgconf/pkgconf	ISC
python	3.14.7	github.com/python/cpython	Python-2.0.1
readline	8.3	www.gnu.org/software/readline	GPL-3.0-only
sed	4.10	www.gnu.org/software/sed	GPL-3.0-only
sqlite	3.53.4	github.com/sqlite/sqlite	blessing
tar	1.35	www.gnu.org/software/tar	GPL-3.0-only
tzdata	2026e	https://data.iana.org/time-zones/releases/tzdata2026e.tar.gz	LicenseRef-Public-Domain
util-linux	2.42.4	github.com/util-linux/util-linux	GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause
xz	5.8.4	github.com/tukaani-project/xz	(0BSD AND GPL-2.0-only AND GPL-3.0-only AND LGPL-2.1-only)
zlib	1.3.2	github.com/madler/zlib	Zlib
zstd	1.5.7	github.com/facebook/zstd	BSD-3-Clause OR GPL-2.0-only

gef

Install package

OpenSSF Score

What is "gef"?

How to use this package

Quick install

Declare as a task dependency in minimal.toml

Build-time vs runtime

Dependencies (4)

Dependency changes

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

CVSS vector

References

Summary

Via

Affected ranges

CVSS vector

References

Summary

Via

Affected ranges

CVSS vector

References

Summary

Via

Affected ranges

CVSS vector

References

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

CVSS vector

References

Summary

Via

Affected ranges

CVSS vector

References

Summary

Via

Affected ranges

CVSS vector

References

Summary

Via

Affected ranges

CVSS vector

References

Summary

Via

Affected ranges

CVSS vector

References

Summary

Via

Affected ranges

References

Summary

Via

Affected ranges

Summary

Via

Affected ranges

References

Summary

Via