Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 9

Vulnerabilities 3

• Critical 9.1
  CVE-2026-6100

  Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

  Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under …

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Apr 13, 2026
• High 7.0
  CVE-2026-4786

  Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

  Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Apr 13, 2026
• Medium 5.7
  CVE-2026-1502

  HTTP client proxy tunnel headers not validated for CR/LF

  CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Apr 10, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-1502
• report
  https://access.redhat.com/security/cve/CVE-2026-4786
• report
  https://access.redhat.com/security/cve/CVE-2026-6100
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10117.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457409
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-1502
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-1502
• article
  https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69
• article
  https://github.com/python/cpython/issues/146211
• article
  https://github.com/python/cpython/pull/146212
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458049
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4786
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4786
• article
  https://github.com/python/cpython/issues/148169
• article
  https://github.com/python/cpython/pull/148170
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457932
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6100
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6100
• article
  https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d
• article
  https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2
• article
  https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20
• article
  https://github.com/python/cpython/issues/148395
• article
  https://github.com/python/cpython/pull/148396
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/