Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4224: When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. CVE-2026-3644: The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python | 0:2.7.18-1.amzn2.0.17 |
| Amazon Linux · 2 | python-debug | 0:2.7.18-1.amzn2.0.17 |
| Amazon Linux · 2 | python-debuginfo | 0:2.7.18-1.amzn2.0.17 |
| Amazon Linux · 2 | python-devel | 0:2.7.18-1.amzn2.0.17 |
| Amazon Linux · 2 | python-libs | 0:2.7.18-1.amzn2.0.17 |
| Amazon Linux · 2 | python-test | 0:2.7.18-1.amzn2.0.17 |
| Amazon Linux · 2 | python-tools | 0:2.7.18-1.amzn2.0.17 |
| Amazon Linux · 2 | tkinter | 0:2.7.18-1.amzn2.0.17 |
Vulnerabilities 2
-
Medium 6.0
Incomplete control character validation in http.cookies
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_o…
-
Medium 6.0
Stack overflow parsing XML with deeply nested DTD content models
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.