Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4224: When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. CVE-2026-3644: The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output(). CVE-2026-2297: The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | python3.13 | 0:3.13.13-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.13-debug | 0:3.13.13-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.13-debuginfo | 0:3.13.13-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.13-debugsource | 0:3.13.13-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.13-devel | 0:3.13.13-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.13-freethreading | 0:3.13.13-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.13-freethreading-debug | 0:3.13.13-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.13-idle | 0:3.13.13-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.13-libs | 0:3.13.13-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.13-test | 0:3.13.13-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.13-tkinter | 0:3.13.13-1.amzn2023.0.1 |
Vulnerabilities 3
-
Medium 6.0
Incomplete control character validation in http.cookies
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_o…
-
Medium 6.0
Stack overflow parsing XML with deeply nested DTD content models
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
-
Medium 5.7
SourcelessFileLoader does not use io.open_code()
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.