PYSEC-2026-1208
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/azure-core/PYSEC-2026-1208.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1208
- Aliases
- Published
- 2026-07-07T16:03:18.455480Z
- Modified
- 2026-07-07T17:47:32.613512309Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Azure Core is vulnerable to deserialization of untrusted data
- Details
-
Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2026-21226
- https://github.com/Azure/azure-sdk-for-python
- https://github.com/Azure/azure-sdk-for-python/blob/6d2e6431ea0991861640e449e51e894247a7771a/sdk/core/azure-core/CHANGELOG.md#1380-2026-01-12
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21226
- https://pypi.org/project/azure-core
- https://github.com/advisories/GHSA-jm66-cg57-jjv5
Affected packages
PyPI / azure-core
Package
- Name
- azure-core
- View open source insights on deps.dev
- Purl
- pkg:pypi/azure-core
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.38.0
Affected versions
1.*
1.0.0b1
1.0.0b2
1.0.0b3
1.0.0b4
1.0.0
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0
1.8.0
1.8.1
1.8.2
1.9.0
1.10.0
1.11.0
1.12.0b1
1.12.0
1.13.0b1
1.13.0
1.14.0b1
1.14.0
1.15.0b1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.19.1
1.20.0
1.20.1
1.21.0
1.21.1
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.24.1
1.24.2
1.25.0
1.25.1
1.26.0
1.26.1
1.26.2
1.26.3
1.26.4
1.27.0
1.27.1
1.28.0
1.29.0
1.29.1
1.29.2
1.29.3
1.29.4
1.29.5
1.29.6
1.29.7
1.30.0
1.30.1
1.30.2
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.35.1
1.36.0
1.37.0