Petr Viktorin (https://github.com/encukou)

stringprep.map_table_b2() deviates from RFC 3454 Table B.2

zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

tarfile extraction filter bypass allows creation of directories outside the destination

Configuration Injection via Carriage Return (\r) in write() method

tarfile.data_filter path traversal bypass allows writing outside the extraction directory

Quadratic Behavior in xml.etree.ElementPath Index Predicates

Tarfile.extract() doesn't fully respect filter parameter

Potential DoS via quadratic complexity in unicodedata.normalize()

tarfile opened in streaming mode mishandles EOF

tarfile extraction filter bypass allows escaping the destination directory