Packages / Debian 12 (Bookworm) / python / pypy3

Package: pypy3 (7.3.11+dfsg-2+deb12u3)

fast alternative implementation of Python 3.x - PyPy interpreter

Other Packages Related to pypy3:

sug: [pypy3-doc]
developer Documentation for PyPy (an alternative Python 3.x interpreter)
sug: [pypy3-tk] (= 7.3.11+dfsg-2+deb12u3)
Tkinter module for PyPy (an alternative Python 3.x interpreter)

Download pypy3

Architecture	Package size	Installed size	Files	Package
amd64	9.5 MiB	57 MiB	list of files	Download
arm64	7.9 MiB	53 MiB	list of files	Download

Package file paths (46)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

/usr/bin/pypy3
/usr/bin/pypy3.9
/usr/bin/pypy3clean
/usr/bin/pypy3compile
/usr/include/pypy3.9/genericaliasobject.h
/usr/include/pypy3.9/graminit.h
/usr/include/pypy3.9/pypy_decl.h
/usr/include/pypy3.9/pypy_macros.h
/usr/include/pypy3.9/pypy_marshal_decl.h
/usr/include/pypy3.9/pypy_structmember_decl.h
/usr/lib/aarch64-linux-gnu/libpypy3.9-c.so
/usr/lib/pypy3.9/_audioop_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_audioop_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_blake2/_blake2b_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_blake2/_blake2b_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_blake2/_blake2s_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_blake2/_blake2s_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_curses_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_curses_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_gdbm_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_gdbm_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_lzma_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_lzma_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_posixshmem_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_posixshmem_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_pwdgrp_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_pwdgrp_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_pypy_openssl.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_pypy_openssl.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_pypy_util_cffi_inner.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_pypy_util_cffi_inner.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_resource_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_resource_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_sha3/_sha3_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_sha3/_sha3_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_sqlite3_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_sqlite3_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/pypy3.9/_syslog_cffi.pypy39-pp73-aarch64-linux-gnu.so
/usr/lib/pypy3.9/_syslog_cffi.pypy39-pp73-x86_64-linux-gnu.so
/usr/lib/x86_64-linux-gnu/libpypy3.9-c.so
/usr/share/doc/pypy3/changelog.Debian.gz
/usr/share/doc/pypy3/copyright
/usr/share/doc/pypy3/NEWS.Debian.gz
/usr/share/doc/pypy3/TODO.Debian
/usr/share/lintian/overrides/pypy3
/usr/share/man/man1/pypy3.1.gz

Field source: Debian 12 (Bookworm) main amd64

Use this package

OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.

Try Debian 12 (Bookworm) in the browser Build an image that includes pypy3

Versions, suites, and repositories

Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.

Version	Release	Architecture	Repository	Package size	Installed size	Publisher repository artifact
7.3.11+dfsg-2+deb12u3	bookworm / main	amd64	Debian 12 · main · amd64	9.5 MiB	57 MiB	pool/main/p/pypy3/pypy3_7.3.11+dfsg-2+deb12u3_amd64.deb
7.3.11+dfsg-2+deb12u3	bookworm / main	arm64	Debian 12 · main · arm64	7.9 MiB	53 MiB	pool/main/p/pypy3/pypy3_7.3.11+dfsg-2+deb12u3_arm64.deb

Field source: Debian 12 (Bookworm) main amd64

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-114583] jython: CVE-2026-114583	Medium(6.9)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected dsa · pypy3 · debian · bookworm `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected dsa · pypy3 · debian · bookworm
[CVE-2026-19553] ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname arg	High(7.6)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-19445] A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certif	Critical(9.2)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-12345] The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of	Medium(6.3)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm
[CVE-2026-76875] PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a craf	Medium(6.3)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-15806] The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matchi	Medium(6)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-17084] The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior w	Medium(6.5)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-18503] Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().	Low(3.3)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm
[CVE-2026-6879] `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-ta	Low(3.7)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-11972] When using the "tarfile" module with a file opened in "streaming mode" (mode="r\|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.	High(8.2)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-0864] When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and v	High(7.5)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-8328] The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeer	Medium(5.9)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-6019] http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the gene	High(8.7)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-1502] CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.	Medium(5.7)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-4519] The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended t	High(7.1)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-3479] pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.	Low(3.3)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2025-69534] Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Ma	High(8.2)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-2297] The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.aud	Medium(5.7)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[CVE-2026-1299] Python vulnerabilities	High(8.2)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12 `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12
[CVE-2025-12781] pypy3: CVE-2025-12781	Low(3.3)	Affected Details (2) `7.3.11+dfsg-2+deb12u3` · amd64 · bookworm Affected dsa · pypy3 · debian · bookworm `7.3.11+dfsg-2+deb12u3` · arm64 · bookworm Affected dsa · pypy3 · debian · bookworm

[Next results]

Last synced: Oct 24, 2026, 3:04:31 AM UTC

[CVE catalog]

Checksums

Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.

7.3.11+dfsg-2+deb12u3 / amd64Observed Sep 1, 2026sha256 21847932176d…72a13650Source-reported digest

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported digest (sha256): 21847932176d570d5b012e10fb807cf0f95ff851c525d9397afbda5a72a13650

Verify download

printf '%s  %s\n' '21847932176d570d5b012e10fb807cf0f95ff851c525d9397afbda5a72a13650' 'pypy3_7.3.11+dfsg-2+deb12u3_amd64.deb' | sha256sum --check --strict -

Field source: Debian 12 (Bookworm) main amd64

7.3.11+dfsg-2+deb12u3 / arm64Observed Sep 1, 2026sha256 e87505a95318…0e0b1f2fSource-reported digest

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported digest (sha256): e87505a9531874ac20374ad88846f47dc94dd88ea0581a3814096a4d0e0b1f2f

Verify download

printf '%s  %s\n' 'e87505a9531874ac20374ad88846f47dc94dd88ea0581a3814096a4d0e0b1f2f' 'pypy3_7.3.11+dfsg-2+deb12u3_arm64.deb' | sha256sum --check --strict -

Field source: Debian 12 (Bookworm) main arm64

Sources

Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Observed SHA-256
9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Result
match verified
Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Observed SHA-256
2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Result
match verified