Description
The 'zipfile' module would not check the validity of the ZIP64 End of
Central Directory (EOCD) Locator record offset value would not be used to
locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be
assumed to be the previous record in the ZIP archive. This could be abused
to create ZIP archives that are handled differently by the 'zipfile' module
compared to other ZIP implementations.
Remediation maintains this behavior, but checks that the offset specified
in the ZIP64 EOCD Locator record matches the expected value.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.9.24, 3.10.0 – < 3.10.19, 3.11.0 – < 3.11.14, 3.12.0 – < 3.12.12, 3.13.0 – < 3.13.10, 3.14.0 – < 3.14.1 | 3.9.24 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jython | No fix yet | — |
| Debian 14 | pypy3 | 7.3.21+dfsg-1 | — |
| Debian 14 | python3.14 | 3.14.0-3 | — |
| Debian 13 | pypy3 +1 | No fix yet | — |
| Debian 13 | python3.13 | 3.13.5-2+deb13u1 | — |
| Debian 12 | pypy3 +1 | No fix yet | — |
| Debian 12 | python3.11 | 3.11.2-6+deb12u7 | — |
| Debian 11 | pypy3 | 7.3.5+dfsg-2+deb11u5 | DLA-4354-1 |
| Debian 11 | python3.9 | 3.9.2-1+deb11u4 | DLA-4445-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | python3.13 | 3.13.7-1ubuntu0.1 | USN-7886-2 |
| Ubuntu 25.10 | python3.14 | No fix yet | — |
| Ubuntu 24.04 LTS | python3.12 | 3.12.3-1ubuntu0.9 | USN-7886-1 |
| Ubuntu 22.04 LTS | python3.10 | 3.10.12-1~22.04.12 | USN-7886-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python2.7 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | python3.11 | 3.11.0~rc1-1~22.04.1~esm6 | USN-7886-1 |
| Ubuntu Pro 20.04 LTS | python2.7 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python3.8 | 3.8.10-0ubuntu1~20.04.18+esm3 | USN-7886-1 |
| Ubuntu Pro 20.04 LTS | python3.9 | 3.9.5-3ubuntu0~20.04.1+esm7 | USN-7886-1 |
| Ubuntu Pro 18.04 LTS | python2.7 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python3.6 | 3.6.9-1~18.04ubuntu1.13+esm7 | USN-7886-1 |
| Ubuntu Pro 18.04 LTS | python3.7 | 3.7.5-2ubuntu1~18.04.2+esm8 | USN-7886-1 |
| Ubuntu Pro 18.04 LTS | python3.8 | 3.8.0-3ubuntu1~18.04.2+esm7 | USN-7886-1 |
| Ubuntu Pro 16.04 LTS | python2.7 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python3.5 | 3.5.2-2ubuntu0~16.04.13+esm20 | USN-7886-1 |
| Ubuntu Pro 14.04 LTS | python2.7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python3.4 | 3.4.3-1ubuntu1~14.04.7+esm17 | USN-7886-1 |
| Ubuntu Pro 14.04 LTS | python3.5 | 3.5.2-2ubuntu0~16.04.4~14.04.1+esm8 | USN-7886-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | python3 +8 | 3.12.12-1.el10_1 | RHSA-2025:23940 |
| RHEL 9 | python3 +8 | 3.9.25-2.el9_7 | RHSA-2025:23342 |
| RHEL 9 | python3.12 +6 | 3.12.12-1.el9_7 | RHSA-2025:23323 |
| RHEL 8 | Cython +1 | 0.29.21-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | PyYAML +1 | 5.4.1-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | mod_wsgi +1 | 4.7.1-7.module+el8.10.0+23075+0aa18782.1 | RHSA-2025:23530 |
| RHEL 8 | numpy +3 | 1.19.4-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | pybind11 +2 | 2.7.1-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | pytest +1 | 6.0.2-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-PyMySQL +1 | 0.10.1-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-attrs +1 | 20.3.0-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-cffi +1 | 1.14.3-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-chardet +1 | 3.0.4-19.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-cryptography +1 | 3.3.1-3.module+el8.10.0+21271+eccd1d86 | RHSA-2025:23530 |
| RHEL 8 | python-idna +1 | 2.10-4.module+el8.10.0+21815+bb024982 | RHSA-2025:23530 |
| RHEL 8 | python-iniconfig +1 | 1.1.1-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-lxml +1 | 4.6.5-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-more-itertools +1 | 8.5.0-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-packaging +1 | 20.4-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-pluggy +1 | 0.13.1-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-ply +1 | 3.11-10.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-psutil +1 | 5.8.0-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-psycopg2 +3 | 2.8.6-3.module+el8.10.0+21142+453d2b75 | RHSA-2025:23530 |
| RHEL 8 | python-py +1 | 1.10.0-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-pycparser +1 | 2.20-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-pysocks +1 | 1.7.1-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-requests +1 | 2.25.0-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-toml +1 | 0.10.1-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-urllib3 +1 | 1.25.10-5.module+el8.10.0+20443+f0a692fe | RHSA-2025:23530 |
| RHEL 8 | python-wcwidth +1 | 0.2.5-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-wheel +2 | 1:0.35.1-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python3.12 +7 | 3.12.12-1.el8_10 | RHSA-2026:0123 |
| RHEL 8 | python39 +7 | 3.9.25-2.module+el8.10.0+23718+1842ae33 | RHSA-2025:23530 |
| RHEL 8 | python39-pip +2 | 20.2.4-9.module+el8.10.0+21329+8d76b841 | RHSA-2025:23530 |
| RHEL 8 | python39-pyparsing +1 | 2.4.7-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python39-setuptools +2 | 50.3.2-7.module+el8.10.0+23406+03055bfb | RHSA-2025:23530 |
| RHEL 8 | python39-six +1 | 1.15.0-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | scipy +1 | 1.5.4-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | python3 +8 | 3.12.9-2.el10_0.4 | RHSA-2026:0353 |
| RHEL 9.6 EUS | python3.12 +6 | 3.12.9-1.el9_6.3 | RHSA-2026:0355 |
| RHEL 9.4 EUS | python3.12 +6 | 3.12.1-4.el9_4.8 | RHSA-2026:0354 |
| Red Hat Hardened Images 1 | python3 +15 | 3.14.4-1.hum1 | RHSA-2026:7661 |
| Red Hat Hardened Images 1 | python3.11 +6 | 3.11.15-4.hum1 | RHSA-2026:8822 |
| Red Hat Hardened Images 1 | python3.12 +6 | 3.12.13-3.hum1 | RHSA-2026:8824 |
| Red Hat Hardened Images 1 | python3.13 +8 | 3.13.13-1.hum1 | RHSA-2026:7443 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | python-unversioned-command | 3.12.12-1.el10_1 | ALSA-2025:23940 |
| AlmaLinux 9 | python3 +7 | 3.9.25-2.el9_7 | ALSA-2025:23342 |
| AlmaLinux 9 | python3.12 +6 | 3.12.12-1.el9_7 | ALSA-2025:23323 |
| AlmaLinux 8 | python3.12 +7 | 3.12.12-1.el8_10 | ALSA-2026:0123 |
| AlmaLinux 8 | python39 +7 | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux 8 | python39-Cython | 0.29.21-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-PyMySQL | 0.10.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-attrs | 20.3.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-cffi | 1.14.3-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-chardet | 3.0.4-19.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-cryptography | 3.3.1-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-idna | 2.10-4.module_el8.10.0+3849+a48d89aa | ALSA-2025:23530 |
| AlmaLinux 8 | python39-iniconfig | 1.1.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-lxml | 4.6.5-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-mod_wsgi | 4.7.1-7.module_el8.10.0+3989+a618fe15.1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-more-itertools | 8.5.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-numpy +2 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-packaging | 20.4-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pip +1 | 20.2.4-9.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pluggy | 0.13.1-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-ply | 3.11-10.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-psutil | 5.8.0-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-psycopg2 +2 | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-py | 1.10.0-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pybind11 +1 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pycparser | 2.20-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pyparsing | 2.4.7-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pysocks | 1.7.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pytest | 6.0.2-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pyyaml | 5.4.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-requests | 2.25.0-3.module_el8.9.0+3634+fb2a896c | ALSA-2025:23530 |
| AlmaLinux 8 | python39-scipy | 1.5.4-5.module_el8.9.0+3634+fb2a896c | ALSA-2025:23530 |
| AlmaLinux 8 | python39-setuptools +1 | 50.3.2-7.module_el8.10.0+4040+9207bbc0 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-six | 1.15.0-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-toml | 0.10.1-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-urllib3 | 1.25.10-5.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-wcwidth | 0.2.5-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-wheel +1 | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | python3.12 | 3.12.12-1.el10_1 | RLSA-2025:23940 |
| Rocky Linux 9 | python3.12 | 3.12.12-1.el9_7 | RLSA-2025:23323 |
| Rocky Linux 9 | python3.9 | 3.9.25-2.el9_7 | RLSA-2025:23342 |
| Rocky Linux 8 | Cython | 0.29.21-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | PyYAML | 5.4.1-1.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | mod_wsgi | 4.7.1-7.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | numpy | 1.19.4-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | pybind11 | 2.7.1-1.module+el8.9.0+1357+a3b80af7 | RLSA-2025:23530 |
| Rocky Linux 8 | pytest | 6.0.2-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-PyMySQL | 0.10.1-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-attrs | 20.3.0-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-cffi | 1.14.3-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-chardet | 3.0.4-19.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | python-cryptography | 3.3.1-3.module+el8.10.0+1697+7e517775 | RLSA-2025:23530 |
| Rocky Linux 8 | python-idna | 2.10-4.module+el8.10.0+1809+41195054 | RLSA-2025:23530 |
| Rocky Linux 8 | python-iniconfig | 1.1.1-2.module+el8.9.0+1332+dd574197 | RLSA-2025:23530 |
| Rocky Linux 8 | python-lxml | 4.6.5-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-more-itertools | 8.5.0-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-packaging | 20.4-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-pluggy | 0.13.1-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-ply | 3.11-10.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | python-psutil | 5.8.0-4.module+el8.9.0+1357+a3b80af7 | RLSA-2025:23530 |
| Rocky Linux 8 | python-psycopg2 | 2.8.6-3.module+el8.10.0+1660+b5b6f004 | RLSA-2025:23530 |
| Rocky Linux 8 | python-py | 1.10.0-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-pycparser | 2.20-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-pysocks | 1.7.1-4.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | python-requests | 2.25.0-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-toml | 0.10.1-5.module+el8.9.0+1332+dd574197 | RLSA-2025:23530 |
| Rocky Linux 8 | python-urllib3 | 1.25.10-5.module+el8.10.0+1545+03246da9 | RLSA-2025:23530 |
| Rocky Linux 8 | python-wcwidth | 0.2.5-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-wheel | 1:0.35.1-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python3.12 | 3.12.12-1.el8_10 | RLSA-2026:0123 |
| Rocky Linux 8 | python3x-pip | 20.2.4-9.module+el8.10.0+1721+e52d6351 | RLSA-2025:23530 |
| Rocky Linux 8 | python3x-pyparsing | 2.4.7-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python3x-setuptools | 50.3.2-7.module+el8.10.0+2057+30213a2b | RLSA-2025:23530 |
| Rocky Linux 8 | python3x-six | 1.15.0-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | scipy | 1.5.4-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | python +1 | 2.7.18-150000.86.1 | SUSE-SU-2025:4389-1, SUSE-SU-2025:4313-1 |
| SLES 15 SP7 | python3 +1 | 3.6.15-150300.10.100.1 | SUSE-SU-2025:4368-1 |
| SLES 15 SP7 | python311-core | 3.11.14-150600.3.38.1 | SUSE-SU-2025:4297-1 |
| SLES 15 SP6 | python +1 | 2.7.18-150000.86.1 | SUSE-SU-2025:4389-1, SUSE-SU-2025:4313-1 |
| SLES 15 SP6 | python3 +1 | 3.6.15-150300.10.100.1 | SUSE-SU-2025:4368-1 |
| SLES 15 SP6 | python311-core | 3.11.14-150600.3.38.1 | SUSE-SU-2025:4297-1 |
| SLES 15 SP5 | python311 +2 | 3.11.14-150400.9.69.1 | SUSE-SU-2025:4257-2 |
| SLES 15 SP4 | python311 +2 | 3.11.14-150400.9.69.1 | SUSE-SU-2025:4257-2, SUSE-SU-2025:4257-1 |
| SLES 12 SP5 | python +2 | 2.7.18-33.56.1 | SUSE-SU-2026:0133-1 |
| SLES 12 SP5 | python3 +1 | 3.4.10-25.163.1 | SUSE-SU-2025:4398-1 |
| SLES 12 SP5 | python36 +1 | 3.6.15-94.1 | SUSE-SU-2025:4487-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 3 | python311 +1 | 3.11.14-150600.3.38.1 | SUSE-SU-2025:4297-1 |
| SLES 3 | python312 +1 | 3.12.12-150600.3.37.1 | SUSE-SU-2025:4258-1 |
| SLES 3 | python313 +1 | 3.13.9-150700.4.26.1 | SUSE-SU-2025:4277-1 |
| SLES for SAP 16.0 | python313 +2 | 3.13.11-160000.1.1 | SUSE-SU-2026:20125-1 |
| SLES for SAP 15 SP5 | python311 +2 | 3.11.14-150400.9.69.1 | SUSE-SU-2025:4257-2 |
| SLES for SAP 15 SP4 | python311 +2 | 3.11.14-150400.9.69.1 | SUSE-SU-2025:4257-2 |
| SLES 16.0 | python313 +2 | 3.13.11-160000.1.1 | SUSE-SU-2026:20125-1 |
| SLE Micro 6.2 | python313 +1 | 3.13.11-160000.1.1 | SUSE-SU-2026:20154-1 |
| SLE Micro 6.1 | python311 +1 | 3.11.14-slfo.1.1_1.1 | SUSE-SU-2025:21207-1 |
| SLE Micro 6.0 | python311 +1 | 3.11.14-1.1 | SUSE-SU-2025:21199-1 |
| SLE Micro 5.5 | python3 +1 | 3.6.15-150300.10.100.1 | SUSE-SU-2025:4368-1 |
| SLE Micro 5.4 | python3 +1 | 3.6.15-150300.10.100.1 | SUSE-SU-2025:4368-1 |
| SLE Micro 5.3 | python3 +1 | 3.6.15-150300.10.100.1 | SUSE-SU-2025:4368-1 |
| SLE Micro 5.2 | python3 +1 | 3.6.15-150300.10.100.1 | SUSE-SU-2025:4368-1 |
| SLE HPC 15 SP5 | python311 +2 | 3.11.14-150400.9.69.1 | SUSE-SU-2025:4257-2 |
| SLE HPC 15 SP4 | python311 +2 | 3.11.14-150400.9.69.1 | SUSE-SU-2025:4257-2 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python310 | 3.10.19-2.1 | openSUSE-SU-2025:15768-1 |
| openSUSE Tumbleweed | python311 | 3.11.14-2.1 | openSUSE-SU-2025:15760-1 |
| openSUSE Tumbleweed | python312 | 3.12.12-2.1 | openSUSE-SU-2025:15742-1 |
| openSUSE Tumbleweed | python313 | 3.13.9-2.1 | openSUSE-SU-2025:15750-1 |
| openSUSE Tumbleweed | python314 | 3.14.0-3.1 | openSUSE-SU-2025:15748-1 |
| openSUSE Tumbleweed | python315 | 3.15.0~a1-1.1 | openSUSE-SU-2025:15713-1 |
| openSUSE Tumbleweed | python39 | 3.9.24-2.1 | openSUSE-SU-2025:15792-1 |
| openSUSE Leap 16.0 | python313 +4 | 3.13.11-160000.1.1 | openSUSE-SU-2026:20081-1 |
| openSUSE Leap 15.6 | python +2 | 2.7.18-150000.86.1 | SUSE-SU-2025:4389-1, SUSE-SU-2025:4313-1 |
| openSUSE Leap 15.6 | python3 +2 | 3.6.15-150300.10.100.1 | SUSE-SU-2025:4368-1 |
| openSUSE Leap 15.6 | python310 +2 | 3.10.19-150400.4.91.3 | SUSE-SU-2025:4352-1 |
| openSUSE Leap 15.6 | python311 +2 | 3.11.14-150600.3.38.1 | SUSE-SU-2025:4297-1 |
| openSUSE Leap 15.6 | python312 +2 | 3.12.12-150600.3.37.1 | SUSE-SU-2025:4258-1 |
| openSUSE Leap 15.6 | python39 +2 | 3.9.24-150300.4.84.1 | SUSE-SU-2025:4221-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3 +7 | 3.9.24-1.amzn2023.0.3 | ALAS2023-2025-1237 |
| Amazon Linux 2023 | python3.11 +6 | 3.11.14-1.amzn2023.0.1 | ALAS2023-2025-1236 |
| Amazon Linux 2023 | python3.12 +6 | 3.12.12-2.amzn2023 | ALAS2023-2025-1232 |
| Amazon Linux 2023 | python3.13 +8 | 3.13.3-3.amzn2023.0.7 | ALAS2023-2025-1235 |
| Amazon Linux 2 | python3 +6 | 3.7.16-1.amzn2.0.20 | ALAS2-2025-3041 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
| Azure Linux 3 | python3 | 3.12.9-5 | — |
| Azure Linux 2 (CBL-Mariner) | python3 | 3.9.19-16 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | python3 +7 | 3.12.12-1.0.1.el10_1 | ELSA-2025-23940 |
| Oracle Linux 9 | python3 +7 | 3.9.25-2.0.1.el9_7 | ELSA-2025-23342 |
| Oracle Linux 9 | python3.12 +6 | 3.12.12-1.0.1.el9_7 | ELSA-2025-23323 |
| Oracle Linux 8 | python3.12 +7 | 3.12.12-1.el8_10 | ELSA-2026-0123 |
| Oracle Linux 8 | python39 +7 | 3.9.25-2.module+el8.10.0+90733+27f37730 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-Cython | 0.29.21-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-PyMySQL | 0.10.1-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-attrs | 20.3.0-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-cffi | 1.14.3-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-chardet | 3.0.4-19.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-cryptography | 3.3.1-3.0.1.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-idna | 2.10-4.module+el8.10.0+90341+71ca88f4 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-iniconfig | 1.1.1-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-lxml | 4.6.5-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-mod_wsgi | 4.7.1-7.module+el8.10.0+90647+49247197.1 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-more-itertools | 8.5.0-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-numpy +2 | 1.19.4-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-packaging | 20.4-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pip +1 | 20.2.4-9.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pluggy | 0.13.1-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-ply | 3.11-10.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-psutil | 5.8.0-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-psycopg2 +2 | 2.8.6-3.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-py | 1.10.0-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pybind11 +1 | 2.7.1-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pycparser | 2.20-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pyparsing | 2.4.7-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pysocks | 1.7.1-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pytest | 6.0.2-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pyyaml | 5.4.1-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-requests | 2.25.0-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-scipy | 1.5.4-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-setuptools +1 | 50.3.2-7.module+el8.10.0+90647+49247197 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-six | 1.15.0-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-toml | 0.10.1-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-urllib3 | 1.25.10-5.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-wcwidth | 0.2.5-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-wheel +1 | 1:0.35.1-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | python-3.10 | 3.10.19-r0 | — |
| Wolfi rolling | python-3.11 | 3.11.14-r0 | — |
| Wolfi rolling | python-3.12 | 3.12.12-r0 | — |
| Wolfi rolling | python-3.13 | 3.13.8-r1 | — |
| Wolfi rolling | python-3.14 | 3.14.0-r2 | — |
Advisories 50
- ALSA-2025:23323 Moderate: python3.12 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:23342 Moderate: python3.9 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:23940 Moderate: python3.12 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:23530 Important: python39:3.9 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:0123 Moderate: python3.12 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:8824 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:8822 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:7661 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7443 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2025:23530 Red Hat Security Advisory: python39:3.9 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:23342 Red Hat Security Advisory: python3.9 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
- WID-SEC-2025-2230 Python (CPython Zipfile Module): Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Sep 3, 2026
- WID-SEC-2026-1730 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 16, 2026
- RHSA-2026:0355 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Jul 7, 2026
- RHSA-2026:0353 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Jul 7, 2026
- RHSA-2026:0354 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Jul 7, 2026
- RHSA-2026:0123 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Jul 7, 2026
- RHSA-2025:23940 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Jul 7, 2026
- RHSA-2025:23323 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Jul 7, 2026
- USN-7886-1 python3.12, python3.11, python3.10, python3.9, python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- WID-SEC-2026-0778 Dell Secure Connect Gateway Policy Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
- USN-7886-2 python3.13 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2026:20081-1 Security update for python313 SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15768-1 python310-3.10.19-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15750-1 python313-3.13.9-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15760-1 python311-3.11.14-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15742-1 python312-3.12.12-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15748-1 python314-3.14.0-3.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15713-1 python315-3.15.0~a1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20154-1 Security update for python313 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20125-1 Security update for python313 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0133-1 Security update for python SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4257-1 Security update for python311 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4277-1 Security update for python313 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4487-1 Security update for python36 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4398-1 Security update for python3 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4257-2 Security update for python311 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4221-1 Security update for python39 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21207-1 Security update for python311 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4258-1 Security update for python312 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21199-1 Security update for python311 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4368-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:4389-1 Security update for python SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15792-1 python39-3.9.24-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:4297-1 Security update for python311 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:4313-1 Security update for python SUSE / openSUSE Security Updates · Feb 4, 2026
- DLA-4445-1 python3.9 - security update Debian Security (DSA / DLA) · Jan 20, 2026
- RLSA-2026:0123 Moderate: python3.12 security update Rocky Linux Security Advisories · Jan 7, 2026
- ELSA-2026-0123 Moderate: python3.12 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 6, 2026
- RLSA-2025:23940 Moderate: python3.12 security update Rocky Linux Security Advisories · Dec 24, 2025
References
- https://github.com/python/cpython/pull/139702 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/ vendor-advisory
- https://github.com/python/cpython/issues/139700 issue-tracking
- https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267 patch
- https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6 patch
- https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46 patch
- https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196 patch
- https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4 patch
- https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388 patch
- https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3 patch