Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 9

Vulnerabilities 6

• High 8.7
  CVE-2026-15308

  Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

  The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 9, 2026
• High 8.2
  CVE-2026-11972

  tarfile opened in streaming mode mishandles EOF

  When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 23, 2026
• High 7.8
  CVE-2026-11940

  tarfile extraction filter bypass allows escaping the destination directory

  tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but re…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Alpine Wolfi
  Jun 23, 2026
• Low 2.4
  CVE-2026-18503

  Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

  Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi
  Aug 10, 2026
• Low 2.0
  CVE-2026-4360

  Tarfile.extract() doesn't fully respect filter parameter

  In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='…

  Python Software Foundation CPython python3 python3.10 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 30, 2026
• Low 2.0
  CVE-2026-6879

  Quadratic Behavior in xml.etree.ElementPath Index Predicates

  `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the firs…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 28, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-11940
• report
  https://access.redhat.com/security/cve/CVE-2026-11972
• report
  https://access.redhat.com/security/cve/CVE-2026-15308
• report
  https://access.redhat.com/security/cve/CVE-2026-4360
• report
  https://access.redhat.com/security/cve/CVE-2026-6879
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-18503
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54554.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494987
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4360
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4360
• article
  https://github.com/python/cpython/issues/151987
• article
  https://github.com/python/cpython/pull/151988
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508122
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6879
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6879
• article
  https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0
• article
  https://github.com/python/cpython/issues/152674
• article
  https://github.com/python/cpython/pull/152676
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491848
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-11940
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-11940
• article
  https://github.com/python/cpython/issues/151558
• article
  https://github.com/python/cpython/pull/151559
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492050
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-11972
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-11972
• article
  https://github.com/python/cpython/issues/151981
• article
  https://github.com/python/cpython/pull/151982
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498608
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-15308
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-15308
• article
  https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
• article
  https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced