Skip to content
OpenAdvisories
Critical RHSA-2026:16699 2 CVEs

Red Hat Security Advisory: python3.12 security update

Published May 13, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python-unversioned-command 0:3.12.9-2.el10_0.9
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3 0:3.12.9-2.el10_0.9
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-debug 0:3.12.9-2.el10_0.9
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-devel 0:3.12.9-2.el10_0.9
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-idle 0:3.12.9-2.el10_0.9
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-libs 0:3.12.9-2.el10_0.9
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-test 0:3.12.9-2.el10_0.9
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-tkinter 0:3.12.9-2.el10_0.9
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3.12 0:3.12.9-2.el10_0.9
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3.12-debuginfo 0:3.12.9-2.el10_0.9
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3.12-debugsource 0:3.12.9-2.el10_0.9

Vulnerabilities 2

  • Critical 9.1
    CVE-2026-6100

    Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

    Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.0
    CVE-2026-4786

    Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

    Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2457932
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458049
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16699.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-4786
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-4786
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-4786
  • article
    https://github.com/python/cpython/issues/148169
  • article
    https://github.com/python/cpython/pull/148170
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/
  • report
    https://access.redhat.com/security/cve/CVE-2026-6100
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6100
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6100
  • article
    https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d
  • article
    https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2
  • article
    https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20
  • article
    https://github.com/python/cpython/issues/148395
  • article
    https://github.com/python/cpython/pull/148396
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/