Skip to content
OpenAdvisories
Critical RHSA-2026:14652 2 CVEs

Red Hat Security Advisory: python3.11 security update

Published May 7, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream python3.11 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream python3.11-debuginfo 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream python3.11-debugsource 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream python3.11-devel 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream python3.11-libs 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream python3.11-tkinter 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb python3.11 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb python3.11-debug 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb python3.11-debuginfo 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb python3.11-debugsource 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb python3.11-idle 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb python3.11-test 0:3.11.11-2.el9_6.7
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb python3.11-tkinter 0:3.11.11-2.el9_6.7

Vulnerabilities 2

  • Critical 9.1
    CVE-2026-6100

    Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

    Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.0
    CVE-2026-4786

    Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

    Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2457932
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458049
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14652.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-4786
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-4786
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-4786
  • article
    https://github.com/python/cpython/issues/148169
  • article
    https://github.com/python/cpython/pull/148170
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/
  • report
    https://access.redhat.com/security/cve/CVE-2026-6100
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6100
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6100
  • article
    https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d
  • article
    https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2
  • article
    https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20
  • article
    https://github.com/python/cpython/issues/148395
  • article
    https://github.com/python/cpython/pull/148396
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/