Summary
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
* python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
* cpython: Out-of-memory when loading Plist (CVE-2025-13837)
* cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
* cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
* cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
* cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
* cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
* python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
* python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | python3.12 | 0:3.12.13-2.el8_10 |
Vulnerabilities 11
-
Critical 9.1
Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under …
-
High 7.5
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that i…
-
High 7.0
Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
-
Medium 6.0
Header injection via newlines in data URL mediatype
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
-
Medium 6.0
Header injection in http.cookies.Morsel
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
-
Medium 6.0
Incomplete control character validation in http.cookies
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_o…
-
Medium 6.0
Stack overflow parsing XML with deeply nested DTD content models
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
-
Medium 5.7
HTTP client proxy tunnel headers not validated for CR/LF
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
-
Medium 5.7
SourcelessFileLoader does not use io.open_code()
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
-
Low 2.1
Out-of-memory when loading Plist
When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
-
Low 1.8
Quadratic complexity in os.path.expandvars() with user-controlled template
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2395108
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2408891
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2418084
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2431366
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2431374
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2444691
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2448168
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2448181
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2457409
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2457932
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458049