Skip to content
OpenAdvisories
High ALSA-2026:85239 3 CVEs

Important: python3 security update

Published Oct 19, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345)
* python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)
* python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 7

ReleasePackageFixed in
AlmaLinux · 8 platform-python 3.6.8-79.el8_10.alma.1
AlmaLinux · 8 platform-python-debug 3.6.8-79.el8_10.alma.1
AlmaLinux · 8 platform-python-devel 3.6.8-79.el8_10.alma.1
AlmaLinux · 8 python3-idle 3.6.8-79.el8_10.alma.1
AlmaLinux · 8 python3-libs 3.6.8-79.el8_10.alma.1
AlmaLinux · 8 python3-test 3.6.8-79.el8_10.alma.1
AlmaLinux · 8 python3-tkinter 3.6.8-79.el8_10.alma.1

Vulnerabilities 3

  • Critical 9.2
    CVE-2026-19445 Public exploit

    Use-after-free of a server-side SSLContext when sni_callback switches contexts

    A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  • High 7.6
    CVE-2026-19553 Public exploit

    SSLContext.wrap_bio() missing validation of server_hostname parameter

    ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be si…

    Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2026-12345 Public exploit

    Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

    The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permiss…

    Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-12345
  • report
    https://access.redhat.com/security/cve/CVE-2026-19445
  • report
    https://access.redhat.com/security/cve/CVE-2026-19553
  • report
    https://bugzilla.redhat.com/2543492
  • report
    https://bugzilla.redhat.com/2544127
  • report
    https://bugzilla.redhat.com/2544138
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-85239.html