Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 7

Vulnerabilities 3

• Low 2.4
  CVE-2026-18503

  Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

  Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi
  Aug 10, 2026
• Low 2.1
  CVE-2026-6019

  BaseCookie.js_output() does not neutralize embedded characters

  http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie …

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi
  Apr 22, 2026
• None 0.0
  CVE-2026-3479

  pkgutil.get_data() does not enforce documented restrictions

  DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the i…

  Python Software Foundation CPython pypy3 python3.11 Debian Wolfi
  Mar 18, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-3479
• report
  https://access.redhat.com/security/cve/CVE-2026-6019
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-18503
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57660.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448746
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-3479
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-3479
• article
  https://github.com/python/cpython/issues/146121
• article
  https://github.com/python/cpython/pull/146122
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460869
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6019
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6019
• article
  https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104
• article
  https://github.com/python/cpython/issues/90309
• article
  https://github.com/python/cpython/pull/148848
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513510
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-18503
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-18503
• article
  https://github.com/python/cpython/issues/98820
• article
  https://github.com/python/cpython/pull/153694
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/