High ELSA-2026-39798 1 CVE

Important: python3.9 security, bug fix, and enhancement update (Oracle Linux 9)

Published Jul 16, 2026 · Updated Jul 16, 2026

Ecosystem: Oracle Linux

Summary

[3.9.25-7.0.1.el9_8.2]
- Remove upstream URL reference

[3.9.25-7.2]
- Security fix for CVE-2026-15308
Resolves: RHEL-193786

[3.9.25-7.1]
- Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+
Resolves: RHEL-194207

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 9	python-unversioned-command	0:3.9.25-7.0.1.el9_8.2
Oracle Linux · 9	python3	0:3.9.25-7.0.1.el9_8.2
Oracle Linux · 9	python3-debug	0:3.9.25-7.0.1.el9_8.2
Oracle Linux · 9	python3-devel	0:3.9.25-7.0.1.el9_8.2
Oracle Linux · 9	python3-idle	0:3.9.25-7.0.1.el9_8.2
Oracle Linux · 9	python3-libs	0:3.9.25-7.0.1.el9_8.2
Oracle Linux · 9	python3-test	0:3.9.25-7.0.1.el9_8.2
Oracle Linux · 9	python3-tkinter	0:3.9.25-7.0.1.el9_8.2

Vulnerabilities 1

High 8.7

CVE-2026-15308

Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi

Jul 9, 2026