oss-security - BioPython 1.87 fixes CVE-2025-68463 (XXE, SSRF)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <e4ab0b96-0c8b-4c45-b2ed-0f4606a5cb06@pipping.org>
Date: Fri, 8 May 2026 18:49:35 +0200
From: Sebastian Pipping <sebastian@...ping.org>
To: oss-security@...ts.openwall.com
Subject: BioPython 1.87 fixes CVE-2025-68463 (XXE, SSRF)

Hello oss-security,


just a quick note that BioPython 1.87 released 2026-03-30 is fixing
CVE-2025-68463: XXE/SSRF in Bio.Entrez.* .

Some key links are:

- The detailed report with PoC
   https://github.com/biopython/biopython/issues/5109

- The two related pull requests
   - https://github.com/biopython/biopython/pull/5114
   - https://github.com/biopython/biopython/pull/5148

- The change log of release 1.87
   https://github.com/biopython/biopython/blob/biopython-187/NEWS.rst

- The official CVE metadata
   https://nvd.nist.gov/vuln/detail/CVE-2025-68463

Best



Sebastian

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.