Skip to content
OpenAdvisories
High ELSA-2026-67943 1 CVE

Important: python-lxml security update (Oracle Linux 8)

Published Sep 18, 2026 · Updated Sep 18, 2026

Summary

[4.2.3-5]
- Security fix for CVE-2026-49825: missing xlink:href in known HTML
link attributes
Resolves: RHEL-251508

[4.2.3-4]
- Security fix for CVE-2021-43818
Resolves: rhbz#2032569

[4.2.3-3]
- Security fix for CVE-2021-28957
Resolves: rhbz#1941534

[4.2.3-2]
- Security fix for CVE-2020-27783: mXSS due to the use of improper parser
Resolves: rhbz#1901633

[4.2.3-1]
- New upstream release 4.2.3

[4.1.1-3]
- Conditionalize the python2 subpackage

[4.1.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[4.1.1-1]
- Update to 4.1.1

[4.0.0-2]
- Conditionally allow building without Cython

[4.0.0-1]
- Update to 4.0.0

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 8 python3-lxml 0:4.2.3-5.el8_10

Vulnerabilities 1

  • High 8.2

    lxml: javascript: URL bypass in Cleaner via xlink:href

    lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerabilit…