Astra Linux – vulnerability in python2.7, python3.7

The urllib.parse.urlsplit and urlparse functions improperly validate bracketed hosts , allowing hosts that are not IPv6 or IPvFuture. This behavior does not comply with RFC 3986 and may enable SSRF if a URL is processed by multiple URL parsers...

ROOT-OS-DEBIAN-12-CVE-2026-11972 CVE-2026-11972 in python3.11 - Patched by Root

Root has patched CVE-2026-11972 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-4360 CVE-2026-4360 in python3.11 - Patched by Root

Root has patched CVE-2026-4360 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-0864 CVE-2026-0864 in python3.11 - Patched by Root

Root has patched CVE-2026-0864 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...

Astra Linux – Vulnerability in Python 3.11

It allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory, and modifying some file metadata. This vulnerability affects users who use the TarFile module to extract untrusted tar archives using TarFile.extractall or TarFile.extract, with the...

OESA-2026-3236 python-Keras security update

Keras is a high-level neural networks API for Python. Security Fixes: Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in keras/src/utils/fileutils.py. The functions filtersafetarinfos and filtersafezipinfos validate archive membe...

GHSA-M2H6-J472-RP4C vulnerabilities

Vulnerabilities for packages: openstack-glance-2026.1, dbt-snowflake, kserve, mlflow, openstack-nova-2025.2, openstack-glance-2025.2, openstack-nova-2026.1, apache-beam-python-3.13-sdk, az, apache-beam-python-3.11-sdk, openstack-glance-2025.1, vllm-openai-cuda-12.9, openstack-nova-2025.1,...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1998)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1998 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated...

Important: python3.11

Issue Overview: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 In the...

EUVD-2026-43956

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs...

SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3132-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3132-1 advisory. This update for python311 fixes the following issues - CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers ...

Security Bulletin: Vulnerability in python (CVE-2026-45186) affects AIX/VIOS.

Summary Denial of service via moderately sized crafted XML input. Vulnerability Details CVEID:CVE-2026-45186 DESCRIPTION: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. CWE:CWE-407:...

DEBIAN-CVE-2026-12482

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filtersafetarinfos validation in keras/src/utils/fileutils.py. Specifically, symlink entries are not subjected to the same ispathindir validation as regular file entries,...

PT-2026-57960

Name of the Vulnerable Software and Affected Versions keras-team/keras version 3.12.0 Description An issue exists in keras/src/utils/file utils.py where the filter safe tarinfos validation is bypassed when processing malicious tar archives. Symlink entries do not undergo the same is path in dir...

PYSEC-2026-1840 Pyramid static view path traversal up one directory

Impact This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be...

Important: python3.11

Issue Overview: The "tarfile" module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.11: python3.11-3.11.15-4.4.hum1 aarch64, x8664 python3.11-debug-3.11.15-4.4.hum1 aarch64, x8664 python3.11-devel-3.11.15-4.4.hum1 aarch64, x8664 python3.11-idle-3.11.15-4.4.hum1 aarch64,...

python3.11 security update

3.11.13-10.0.1 - Remove upstream URL reference Orabug: 36073032 3.11.13-10 - Depend on sqlite-libs with deserialize API Resolves: RHEL-178519...

Astra Linux – vulnerability in python3.11

The email module, specifically the “BytesGenerator” class, fails to properly quote newlines in email headers when serializing an email message. This results in header injection capabilities when such emails are serialized. This issue occurs only when using “LiteralHeader” to write headers that do...

Astra Linux – vulnerability in python3.11

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model, a C stack overflow occurs...