Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 7

Vulnerabilities 3

• High 8.7
  CVE-2026-15308

  Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

  The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 9, 2026
• High 7.8
  CVE-2026-11940

  tarfile extraction filter bypass allows escaping the destination directory

  tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but re…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Alpine Wolfi
  Jun 23, 2026
• High 7.5
  CVE-2025-4330

  Extraction filter bypass for linking outside extraction directory

  Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives u…

  Python Software Foundation CPython python3 python3.12 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 3, 2025

References

• report
  https://access.redhat.com/security/cve/CVE-2025-4330
• report
  https://access.redhat.com/security/cve/CVE-2026-11940
• report
  https://access.redhat.com/security/cve/CVE-2026-15308
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38017.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2370014
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-4330
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-4330
• article
  https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f
• article
  https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a
• article
  https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a
• article
  https://github.com/python/cpython/issues/135034
• article
  https://github.com/python/cpython/pull/135037
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491848
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-11940
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-11940
• article
  https://github.com/python/cpython/issues/151558
• article
  https://github.com/python/cpython/pull/151559
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498608
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-15308
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-15308
• article
  https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
• article
  https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
• article
  https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
• article
  https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
• article
  https://github.com/python/cpython/issues/153030
• article
  https://github.com/python/cpython/pull/153031
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/