Red Hat Security Advisory: python3.9 security update

Fixed packages 17

Vulnerabilities 4

• Critical 9.2
  CVE-2026-19445 Public exploit

  Use-after-free of a server-side SSLContext when sni_callback switches contexts

  A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  Sep 30, 2026
• High 7.6
  CVE-2026-19553 Public exploit

  SSLContext.wrap_bio() missing validation of server_hostname parameter

  ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be si…

  Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine
  Sep 30, 2026
• Medium 6.9
  CVE-2026-114583

  tar filter allows writing outside destination via empty-named symlink

  tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extracta…

  Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 22, 2026
• Medium 5.9
  CVE-2026-12345 Public exploit

  Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

  The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permiss…

  Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 29, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543492
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2544127
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2544138
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2559388
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98511.json
• report
  https://access.redhat.com/security/cve/CVE-2026-12345
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-12345
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-12345
• article
  https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d
• article
  https://github.com/python/cpython/issues/157579
• article
  https://github.com/python/cpython/pull/157580
• report
  https://access.redhat.com/security/cve/CVE-2026-19445
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-19445
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-19445
• article
  https://github.com/python/cpython/issues/156293
• article
  https://github.com/python/cpython/pull/158504
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/
• report
  https://access.redhat.com/security/cve/CVE-2026-19553
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-19553
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-19553
• article
  https://github.com/python/cpython/issues/156793
• article
  https://github.com/python/cpython/pull/158503
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/
• report
  https://access.redhat.com/security/cve/CVE-2026-114583
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-114583
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-114583
• article
  https://github.com/python/cpython/issues/160097
• article
  https://github.com/python/cpython/pull/160098
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/