Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 7

Vulnerabilities 2

• High 8.7
  CVE-2026-15308

  Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

  The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 9, 2026
• High 7.8
  CVE-2026-11940

  tarfile extraction filter bypass allows escaping the destination directory

  tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but re…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Alpine Wolfi
  Jun 23, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-11940
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-15308
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38018.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491848
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-11940
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-11940
• article
  https://github.com/python/cpython/issues/151558
• article
  https://github.com/python/cpython/pull/151559
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498608
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-15308
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-15308
• article
  https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
• article
  https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
• article
  https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
• article
  https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
• article
  https://github.com/python/cpython/issues/153030
• article
  https://github.com/python/cpython/pull/153031
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/