Description
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lxml | lxml | < 6.1.1 | — |
| fedora-python | lxml_html_clean | < 0.4.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lxml | 6.1.3-1 | — |
| Debian 14 | lxml-html-clean | 0.4.5-1 | — |
| Debian 13 | lxml +1 | No fix yet | — |
| Debian 12 | lxml | 4.9.2-1+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | lxml | 6.0.2-1ubuntu0.1 | USN-8897-1 |
| Ubuntu 24.04 LTS | lxml | 5.2.1-1ubuntu0.2 | USN-8897-1 |
| Ubuntu 22.04 LTS | lxml | 4.8.0-1ubuntu0.1 | USN-8897-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | lxml | 4.5.0-1ubuntu0.5+esm1 | USN-8897-1 |
| Ubuntu Pro 18.04 LTS | lxml | 4.2.1-1ubuntu0.6+esm1 | USN-8897-1 |
| Ubuntu Pro 16.04 LTS | lxml | 3.5.0-1ubuntu0.4+esm3 | USN-8897-1 |
| Ubuntu Pro 14.04 LTS | lxml | 3.3.3-1ubuntu0.2+esm6 | USN-8897-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | python-lxml +1 | 4.6.5-3.el9_8.1 | RHSA-2026:66204 |
| RHEL 9 | python3.12-lxml | 4.9.3-2.el9_8.1 | RHSA-2026:66203 |
| RHEL 8 | python-lxml +1 | 4.2.3-5.el8_10 | RHSA-2026:67943 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.12.0.23-1.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite Utils 6 | rubygem-hammer_cli | 3.12.0-2.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite Utils 6 | satellite +1 | 6.16.14-1.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.12.0.23-1.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite Capsule 6 | python-dynaconf +1 | 3.2.13-1.el8pc | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite Capsule 6 | python-gitpython +1 | 3.1.62-1.el8pc | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite Capsule 6 | python-lxml +1 | 4.9.2-5.el8pc | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite Capsule 6 | python-pulpcore +1 | 3.49.39-4.el8pc | RHSA-2026:74506 |
| Red Hat Satellite Capsule 6 | python-sqlparse +1 | 0.6.0-1.el8pc | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite Capsule 6 | satellite +2 | 6.16.14-1.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite Capsule 6 | satellite-obsolete-packages | 6.17.12-1.el9sat | RHSA-2026:74505 |
| Red Hat Satellite 6 | foreman +14 | 3.12.0.23-1.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite 6 | python-dynaconf +1 | 3.2.13-1.el8pc | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite 6 | python-gitpython +1 | 3.1.62-1.el8pc | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite 6 | python-lxml +1 | 4.9.2-5.el8pc | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite 6 | python-pulpcore +1 | 3.49.39-4.el8pc | RHSA-2026:74506 |
| Red Hat Satellite 6 | python-sqlparse +1 | 0.6.0-1.el8pc | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite 6 | rubygem-foreman_remote_execution +1 | 13.2.8-2.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite 6 | rubygem-hammer_cli | 3.12.0-2.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite 6 | rubygem-katello | 4.14.0.23-1.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite 6 | rubygem-safemode | 1.5.0-2.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite 6 | satellite +2 | 6.16.14-1.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| Red Hat Satellite 6 | satellite-obsolete-packages | 6.17.12-1.el9sat | RHSA-2026:74505 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.1.0-2.el8sat | RHSA-2026:74506, RHSA-2026:74505 |
| RHEL 9.6 EUS | python-lxml +1 | 4.6.5-3.el9_6.1 | RHSA-2026:67324 |
| RHEL 9.6 EUS | python3.12-lxml | 4.9.3-2.el9_6.1 | RHSA-2026:74081 |
| RHEL 9.4 E4S | python-lxml +1 | 4.6.5-3.el9_4.1 | RHSA-2026:67325 |
| RHEL 9.4 E4S | python3.12-lxml | 4.9.3-2.el9_4.1 | RHSA-2026:74082 |
| RHEL 9.2 E4S | python-lxml +1 | 4.6.5-3.el9_2.1 | RHSA-2026:67326 |
| RHEL 8.8 TUS | python-lxml +1 | 4.2.3-4.el8_8.1 | RHSA-2026:84593 |
| RHEL 8.8 E4S | python-lxml +1 | 4.2.3-4.el8_8.1 | RHSA-2026:84593 |
| RHEL 8.6 EUS Long Life | python-lxml +1 | 4.2.3-4.el8_6.1 | RHSA-2026:84592 |
| RHEL 8.6 AUS | python-lxml +1 | 4.2.3-4.el8_6.1 | RHSA-2026:84592 |
| RHEL 8.4 EUS Long Life | python-lxml +1 | 4.2.3-2.el8_4.1 | RHSA-2026:90326 |
| RHEL 8.4 AUS | python-lxml +1 | 4.2.3-2.el8_4.1 | RHSA-2026:90326 |
| RHEL 7 ELS | python-lxml +1 | 3.2.1-4.el7_9.1 | RHSA-2026:90327 |
| RHEL 6 ELS | python-lxml | 2.2.3-1.2.el6_10 | RHSA-2026:90336 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | python3-lxml | 4.6.5-3.el9_8.1 | ALSA-2026:66204 |
| AlmaLinux 9 | python3.12-lxml | 4.9.3-2.el9_8.1 | ALSA-2026:66203 |
| AlmaLinux 8 | python3-lxml | 4.2.3-5.el8_10 | ALSA-2026:67943 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | python-lxml | 4.6.5-3.el9_8.1 | RLSA-2026:66204 |
| Rocky Linux 9 | python3.12-lxml | 4.9.3-2.el9_8.1 | RLSA-2026:66203 |
| Rocky Linux 8 | python-lxml | 4.2.3-5.el8_10 | RLSA-2026:67943 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy +1 | 3.11.15-80002.4.15.4 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cffi | 1.17.1-80002.3.6.5 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cryptography | 3.3.2-80002.3.6.5 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cssselect | 1.3.0-80002.3.6.5 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-editables | 0.5-80002.3.3.5 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-exceptiongroup +1 | 1.2.2-80002.3.3.5 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-flit-core | 3.12.0-80002.3.3.4 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatch-fancy-pypi-readme +1 | 25.1.0-80002.3.3.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatch-vcs +1 | 0.5.0-80002.3.3.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatchling | 1.31.0-80002.3.3.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-idna | 3.10-80002.3.6.5 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-iniconfig | 2.1.0-80002.3.3.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-iniconfig-test | 2.1.0-80002.3.3.5 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-jinja2 | 3.1.6-80002.5.3.5 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-lxml | 6.1.1-80002.3.9.5 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-packaging | 24.2-80002.3.3.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pip | 25.0.1-80002.3.3.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyasn1 | 0.6.3-80002.3.6.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyasn1-modules | 0.4.2-80002.3.6.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyopenssl | 23.2.0-80002.3.9.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyparsing | 3.0.9-80002.3.6.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-requests | 2.34.2-80002.4.6.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-tornado | 6.3.2-80002.4.12.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-urllib3 | 2.0.7-80002.3.6.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-websocket-client | 1.9.0-80002.3.6.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | scap-security-guide | 0.1.80-80002.3.12.4 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | spacecmd | 5.2.10-80002.3.15.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | uyuni-tools | 5.2.17-80002.3.15.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update | venv-salt-minion | 3006.0-80002.5.22.3 | SUSE-SU-2026:4581-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | mgr-push | 5.2.5-70002.3.12.2 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy +1 | 3.11.15-70002.4.15.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cffi | 1.17.1-70002.3.6.2 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cryptography | 3.3.2-70002.3.6.2 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cssselect | 1.3.0-70002.3.6.2 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-editables | 0.5-70002.3.3.2 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-exceptiongroup +1 | 1.2.2-70002.3.3.2 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-flit-core | 3.12.0-70002.3.3.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatch-fancy-pypi-readme +1 | 25.1.0-70002.3.3.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatch-vcs +1 | 0.5.0-70002.3.3.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatchling | 1.31.0-70002.3.3.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-idna | 3.10-70002.3.6.2 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-iniconfig | 2.1.0-70002.3.3.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-iniconfig-test | 2.1.0-70002.3.3.2 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-jinja2 | 3.1.6-70002.5.3.2 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-lxml | 6.1.1-70002.3.9.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-packaging | 24.2-70002.3.3.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pip | 25.0.1-70002.3.3.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyasn1 | 0.6.3-70002.3.6.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyasn1-modules | 0.4.2-70002.3.6.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyopenssl | 23.2.0-70002.3.9.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyparsing | 3.0.9-70002.3.6.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-requests | 2.34.2-70002.4.6.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-tornado | 6.3.2-70002.4.12.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-urllib3 | 2.0.7-70002.3.6.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-websocket-client | 1.9.0-70002.3.6.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | spacecmd | 5.2.10-70002.3.15.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | spacewalk-client-tools | 5.2.7-70002.3.12.1 | SUSE-SU-2026:4583-1 |
| SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update | venv-salt-minion | 3006.0-70002.5.22.1 | SUSE-SU-2026:4583-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.17-150002.3.20.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | venv-salt-minion | 3006.0-150002.5.22.1 | SUSE-SU-2026:4585-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.13.2-150002.3.19.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 12.4.10-150002.4.27.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.5-150002.3.12.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.10-150002.3.15.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.7-150002.3.12.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.17-150002.3.20.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | venv-salt-minion | 3006.0-150002.5.22.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-12 | mgr-push | 5.2.5-120002.3.12.1 | SUSE-SU-2026:4584-1 |
| SUSE Multi Linux Manager Tools SLE-12 | spacecmd | 5.2.10-120002.3.15.1 | SUSE-SU-2026:4584-1 |
| SUSE Multi Linux Manager Tools SLE-12 | spacewalk-client-tools | 5.2.7-120002.3.12.1 | SUSE-SU-2026:4584-1 |
| SUSE Multi Linux Manager Tools SLE-12 | uyuni-tools | 5.2.17-120002.3.18.1 | SUSE-SU-2026:4584-1 |
| SUSE Multi Linux Manager Tools SLE-12 | venv-salt-minion | 3006.0-120002.5.22.2 | SUSE-SU-2026:4584-1 |
| SUSE Multi Linux Manager Tools RES-7 | mgr-push | 5.2.5-70002.3.12.2 | SUSE-SU-2026:4583-1 |
| SUSE Multi Linux Manager Tools RES-7 | spacecmd | 5.2.10-70002.3.15.1 | SUSE-SU-2026:4583-1 |
| SUSE Multi Linux Manager Tools RES-7 | spacewalk-client-tools | 5.2.7-70002.3.12.1 | SUSE-SU-2026:4583-1 |
| SUSE Multi Linux Manager Tools RES-7 | venv-salt-minion | 3006.0-70002.5.22.1 | SUSE-SU-2026:4583-1 |
| SUSE Multi Linux Manager Tools EL-10 | scap-security-guide | 0.1.80-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE Multi Linux Manager Tools EL-10 | spacecmd | 5.2.10-100002.1.9.1 | SUSE-SU-2026:4580-1 |
| SUSE Multi Linux Manager Tools EL-10 | uyuni-tools | 5.2.17-100002.1.9.1 | SUSE-SU-2026:4580-1 |
| SUSE Multi Linux Manager Tools EL-10 | venv-salt-minion | 3006.0-100002.1.13.1 | SUSE-SU-2026:4580-1 |
| SUSE Multi Linux Manager Tools EL-9 | scap-security-guide | 0.1.80-90002.3.12.1 | SUSE-SU-2026:4582-1 |
| SUSE Multi Linux Manager Tools EL-9 | spacecmd | 5.2.10-90002.3.15.1 | SUSE-SU-2026:4582-1 |
| SUSE Multi Linux Manager Tools EL-9 | uyuni-tools | 5.2.17-90002.3.15.1 | SUSE-SU-2026:4582-1 |
| SUSE Multi Linux Manager Tools EL-9 | venv-salt-minion | 3006.0-90002.5.22.1 | SUSE-SU-2026:4582-1 |
| SUSE Multi Linux Manager Tools EL-8 | scap-security-guide | 0.1.80-80002.3.12.4 | SUSE-SU-2026:4581-1 |
| SUSE Multi Linux Manager Tools EL-8 | spacecmd | 5.2.10-80002.3.15.3 | SUSE-SU-2026:4581-1 |
| SUSE Multi Linux Manager Tools EL-8 | uyuni-tools | 5.2.17-80002.3.15.3 | SUSE-SU-2026:4581-1 |
| SUSE Multi Linux Manager Tools EL-8 | venv-salt-minion | 3006.0-80002.5.22.3 | SUSE-SU-2026:4581-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy +1 | 3.11.15-100002.1.9.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cffi | 1.17.1-100002.1.6.2 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cryptography | 3.3.2-100002.1.6.2 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cssselect | 1.3.0-100002.1.6.2 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-editables | 0.5-100002.1.6.2 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-exceptiongroup +1 | 1.2.2-100002.1.6.2 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-flit-core | 3.12.0-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatch-fancy-pypi-readme +1 | 25.1.0-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatch-vcs +1 | 0.5.0-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatchling | 1.31.0-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-idna | 3.10-100002.1.6.2 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-iniconfig | 2.1.0-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-iniconfig-test | 2.1.0-100002.1.6.2 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-jinja2 | 3.1.6-100002.1.6.2 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-lxml | 6.1.1-100002.1.9.2 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-packaging | 24.2-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pip | 25.0.1-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyasn1 | 0.6.3-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyasn1-modules | 0.4.2-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyopenssl | 23.2.0-100002.1.9.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyparsing | 3.0.9-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-requests | 2.34.2-100002.1.9.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-tornado | 6.3.2-100002.1.9.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-urllib3 | 2.0.7-100002.1.9.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-websocket-client | 1.9.0-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | scap-security-guide | 0.1.80-100002.1.6.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | spacecmd | 5.2.10-100002.1.9.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | uyuni-tools | 5.2.17-100002.1.9.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update | venv-salt-minion | 3006.0-100002.1.13.1 | SUSE-SU-2026:4580-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy +1 | 3.11.15-90002.4.15.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cffi | 1.17.1-90002.3.6.2 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cryptography | 3.3.2-90002.3.6.2 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-cssselect | 1.3.0-90002.3.6.2 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-editables | 0.5-90002.3.3.2 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-exceptiongroup +1 | 1.2.2-90002.3.3.2 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-flit-core | 3.12.0-90002.3.3.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatch-fancy-pypi-readme +1 | 25.1.0-90002.3.3.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatch-vcs +1 | 0.5.0-90002.3.3.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-hatchling | 1.31.0-90002.3.3.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-idna | 3.10-90002.3.6.2 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-iniconfig | 2.1.0-90002.3.3.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-iniconfig-test | 2.1.0-90002.3.3.2 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-jinja2 | 3.1.6-90002.5.3.2 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-lxml | 6.1.1-90002.3.9.2 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-packaging | 24.2-90002.3.3.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pip | 25.0.1-90002.3.3.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyasn1 | 0.6.3-90002.3.6.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyasn1-modules | 0.4.2-90002.3.6.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyopenssl | 23.2.0-90002.3.9.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-pyparsing | 3.0.9-90002.3.6.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-requests | 2.34.2-90002.4.6.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-tornado | 6.3.2-90002.4.12.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-urllib3 | 2.0.7-90002.3.6.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | saltbundlepy-websocket-client | 1.9.0-90002.3.6.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | scap-security-guide | 0.1.80-90002.3.12.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | spacecmd | 5.2.10-90002.3.15.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | uyuni-tools | 5.2.17-90002.3.15.1 | SUSE-SU-2026:4582-1 |
| SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update | venv-salt-minion | 3006.0-90002.5.22.1 | SUSE-SU-2026:4582-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-lxml | 6.1.1-1.1 | openSUSE-SU-2026:11147-1 |
| openSUSE Tumbleweed | python-lxml_html_clean | 0.4.5-1.1 | openSUSE-SU-2026:11191-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-lxml | 4.9.3-3 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | python3-lxml | 4.2.3-5.el8_10 | ELSA-2026-67943 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | lxml-html-clean | < 0.4.5 | 0.4.5 | GHSA-4jhm-jv67-739f |
Advisories 33
- RHSA-2026:90326 Red Hat Security Advisory: python-lxml security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:90336 Red Hat Security Advisory: python-lxml security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:90327 Red Hat Security Advisory: python-lxml security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3555 Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- WID-SEC-2026-3292 Red Hat Enterprise Linux (lxml): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 11, 2026
- ALSA-2026:66203 Important: python3.12-lxml security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:66204 Important: python-lxml security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:67943 Important: python-lxml security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:84593 Red Hat Security Advisory: python-lxml security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:84592 Red Hat Security Advisory: python-lxml security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74506 Red Hat Security Advisory: Satellite 6.16.14 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74505 Red Hat Security Advisory: Satellite 6.17.12 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74081 Red Hat Security Advisory: python3.12-lxml security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74082 Red Hat Security Advisory: python3.12-lxml security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67943 Red Hat Security Advisory: python-lxml security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67325 Red Hat Security Advisory: python-lxml security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67326 Red Hat Security Advisory: python-lxml security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67324 Red Hat Security Advisory: python-lxml security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:66204 Red Hat Security Advisory: python-lxml security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:66203 Red Hat Security Advisory: python3.12-lxml security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- USN-8897-1 lxml vulnerabilities Ubuntu Security Notices (USN) · Oct 8, 2026
- SUSE-SU-2026:4585-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
- SUSE-SU-2026:4583-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
- SUSE-SU-2026:4580-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
- SUSE-SU-2026:4584-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
- SUSE-SU-2026:4581-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
- SUSE-SU-2026:4582-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
- ELSA-2026-67943 Important: python-lxml security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 18, 2026
- RLSA-2026:67943 Important: python-lxml security update Rocky Linux Security Advisories · Sep 17, 2026
- RLSA-2026:66203 Important: python3.12-lxml security update Rocky Linux Security Advisories · Sep 11, 2026
- RLSA-2026:66204 Important: python-lxml security update Rocky Linux Security Advisories · Sep 11, 2026
- openSUSE-SU-2026:11191-1 python313-lxml_html_clean-0.4.5-1.1 on GA media SUSE / openSUSE Security Updates · Jul 7, 2026
- openSUSE-SU-2026:11147-1 python-lxml-doc-6.1.1-1.1 on GA media SUSE / openSUSE Security Updates · Jun 30, 2026
References
- https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f
- https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2
- https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0
- https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5
- https://github.com/lxml/lxml/releases/tag/lxml-6.1.1