Medium ELSA-2026-18957 1 CVE

Moderate: python3.11 security update (Oracle Linux 9)

Published Jun 29, 2026 · Updated Jun 29, 2026

Ecosystem: Oracle Linux

Summary

[3.11.13-10.0.1]
- Remove upstream URL reference [Orabug: 36073032]

[3.11.13-10]
- Depend on sqlite-libs with (de)serialize API
Resolves: RHEL-178519

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 9	python3.11	0:3.11.13-10.0.1.el9_8
Oracle Linux · 9	python3.11-debug	0:3.11.13-10.0.1.el9_8
Oracle Linux · 9	python3.11-devel	0:3.11.13-10.0.1.el9_8
Oracle Linux · 9	python3.11-idle	0:3.11.13-10.0.1.el9_8
Oracle Linux · 9	python3.11-libs	0:3.11.13-10.0.1.el9_8
Oracle Linux · 9	python3.11-test	0:3.11.13-10.0.1.el9_8
Oracle Linux · 9	python3.11-tkinter	0:3.11.13-10.0.1.el9_8

Vulnerabilities 1

Medium 5.9

CVE-2026-0865

wsgiref.headers.Headers allows header newline injection

User-controlled header names and values containing newlines can allow injecting HTTP headers.

Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi

Jan 20, 2026