Skip to content
OpenAdvisories
High ALAS2-2026-3845 3 CVEs

Important: python security update (Amazon Linux 2)

Published Aug 3, 2026 · Updated Aug 4, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-3446: When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data. CVE-2026-15308: The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-1502: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 python 0:2.7.18-1.amzn2.0.22
Amazon Linux · 2 python-debug 0:2.7.18-1.amzn2.0.22
Amazon Linux · 2 python-debuginfo 0:2.7.18-1.amzn2.0.22
Amazon Linux · 2 python-devel 0:2.7.18-1.amzn2.0.22
Amazon Linux · 2 python-libs 0:2.7.18-1.amzn2.0.22
Amazon Linux · 2 python-test 0:2.7.18-1.amzn2.0.22
Amazon Linux · 2 python-tools 0:2.7.18-1.amzn2.0.22
Amazon Linux · 2 tkinter 0:2.7.18-1.amzn2.0.22

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-1502.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-15308.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-3446.html