Most recent entries from all

ALSA-2026:19019 — Important: python3.14 security update

Affected: AlmaLinux:10: python3.14, AlmaLinux:10: python3.14-debug, AlmaLinux:10: python3.14-devel, AlmaLinux:10: python3.14-freethreading, AlmaLinux:10: python3.14-freethreading-debug, AlmaLinux:10: python3.14-freethreading-devel, AlmaLinux:10: python3.14-freethreading-idle, AlmaLinux:10: python3.14-freethreading-libs, AlmaLinux:10: python3.14-freethreading-test, AlmaLinux:10: python3.14-freethreading-tkinter and 4 more

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-08065

BELL-CVE-2026-5713

Affected: Alpaquita:stream: python3, BellSoft Hardened Containers:stream: python3

BIT-libpython-2026-5713 — Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

Affected: Bitnami: libpython

The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.

certfr-2026-avi-0437 — Une vulnérabilité a été découverte dans Python. Elle permet à un attaquant de provoquer un déni de service à distance.

certfr-2026-avi-0437

EUVD-2026-343256

fkie_cve-2026-5713

GHSA-2w92-jcqh-43jc

openSUSE-SU-2026:11181-1 — python314-3.14.6-1.1 on GA media

python314-3.14.6-1.1 on GA media

RHSA-2026:7443 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

python: Quadratic complexity in os.path.expandvars() with user-controlled template cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked cpython: Missing character filtering in Python cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service cpython: cpython: `tarfile` module misinterprets crafted tar archives leading to data integrity issues cpython: Excessive read buffering DoS in http.client cpython: Out-of-memory when loading Plist cpython: Header injection via newlines in data URL mediatype in Python cpython: POP3 command injection in user-controlled commands cpython: wsgiref.headers.Headers allows header newline injection in Python cpython: email header injection due to unquoted newlines cpython: CPython: Logging Bypass in Legacy .pyc File Handling python: Python base64: Incomplete data decoding due to premature stop at padding python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation cpython: Incomplete control character validation in http.cookies cpython: Stack overflow parsing XML with deeply nested DTD content models python: Python: Command-line option injection in webbrowser.open() via crafted URLs python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process.

RLSA-2026:19176 — Important: python3.14 security update

Affected: Rocky Linux:9: python3.14

Security Fix(es):

* cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)

* cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

* cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

* cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

* python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

* python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

* python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

* python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-5713

Affected: Ubuntu:25.10: python3.14, Ubuntu:26.04:LTS: python3.14

WID-SEC-W-2026-1121 — CPython: Schwachstelle ermöglicht Manipulation von Daten

Ein lokaler Angreifer kann eine Schwachstelle in CPython ausnutzen, um Daten zu manipulieren.