Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
python3.12 Update Fixes Multiple Security Risks
published 5 months ago
Summary
This update fixes several security issues in Python 3.12, including potential memory exhaustion, data injection, and code execution. Affected users should update their Python installations to the latest version to protect against these risks. Regular security updates are essential to ensure the integrity and reliability of your system.
What to do
- Update almalinux python-unversioned-command to version 3.12.13-2.el10_2.
- Update almalinux python3 to version 3.12.13-2.el10_2.
- Update almalinux python3-debug to version 3.12.13-2.el10_2.
- Update almalinux python3-devel to version 3.12.13-2.el10_2.
- Update almalinux python3-idle to version 3.12.13-2.el10_2.
- Update almalinux python3-libs to version 3.12.13-2.el10_2.
- Update almalinux python3-test to version 3.12.13-2.el10_2.
- Update almalinux python3-tkinter to version 3.12.13-2.el10_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | python-unversioned-command |
< 3.12.13-2.el10_2 Fix: upgrade to 3.12.13-2.el10_2
|
| AlmaLinux:10 | almalinux | python3 |
< 3.12.13-2.el10_2 Fix: upgrade to 3.12.13-2.el10_2
|
| AlmaLinux:10 | almalinux | python3-debug |
< 3.12.13-2.el10_2 Fix: upgrade to 3.12.13-2.el10_2
|
| AlmaLinux:10 | almalinux | python3-devel |
< 3.12.13-2.el10_2 Fix: upgrade to 3.12.13-2.el10_2
|
| AlmaLinux:10 | almalinux | python3-idle |
< 3.12.13-2.el10_2 Fix: upgrade to 3.12.13-2.el10_2
|
| AlmaLinux:10 | almalinux | python3-libs |
< 3.12.13-2.el10_2 Fix: upgrade to 3.12.13-2.el10_2
|
| AlmaLinux:10 | almalinux | python3-test |
< 3.12.13-2.el10_2 Fix: upgrade to 3.12.13-2.el10_2
|
| AlmaLinux:10 | almalinux | python3-tkinter |
< 3.12.13-2.el10_2 Fix: upgrade to 3.12.13-2.el10_2
|
Original advisory text
Important: python3.12 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
* python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
* cpython: Out-of-memory when loading Plist (CVE-2025-13837)
* cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
* cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
* cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
* cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
* cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
* python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
* python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
* python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
* python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
* cpython: Out-of-memory when loading Plist (CVE-2025-13837)
* cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
* cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
* cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
* cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
* cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
* python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
* python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
* python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:19064 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-13837 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-15282 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-59375 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-6075 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0672 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-1502 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-2297 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-3644 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-4224 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-4519 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-4786 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-6100 Third Party Advisory
- https://bugzilla.redhat.com/2395108 Third Party Advisory
- https://bugzilla.redhat.com/2408891 Third Party Advisory
- https://bugzilla.redhat.com/2418084 Third Party Advisory
- https://bugzilla.redhat.com/2431366 Third Party Advisory
- https://bugzilla.redhat.com/2431374 Third Party Advisory
- https://bugzilla.redhat.com/2444691 Third Party Advisory
- https://bugzilla.redhat.com/2448168 Third Party Advisory
- https://bugzilla.redhat.com/2448181 Third Party Advisory
- https://bugzilla.redhat.com/2449649 Third Party Advisory
- https://bugzilla.redhat.com/2457409 Third Party Advisory
- https://bugzilla.redhat.com/2457932 Third Party Advisory
- https://bugzilla.redhat.com/2458049 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-19064.html Vendor Advisory
Timeline
Published19 May 2026
Updated26 May 2026
First seen26 May 2026
Sources
ALSA-2026:19064 · OSV
Track software like this
Free during beta