Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-3231)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3231 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-3232)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3232 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-3229)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3229 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-3230)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3230 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Important: python3.12

Issue Overview: When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. CVE-2026-15310 The HTTPPasswordMgr class in the urllib.request module, along with its...

Important: python3.11

Issue Overview: When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. CVE-2026-15310 The HTTPPasswordMgr class in the urllib.request module, along with its...

Important: python3.14

Issue Overview: When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. CVE-2026-15310 The HTTPPasswordMgr class in the urllib.request module, along with its...

CLSA-2026-1791403199 python3.9: Fix of CVE-2026-17084

CVE-2026-17084: stringprep: use only Unicode 3.2.0 data for the RFC 3454 B.2/B.3 tables, so IDNA 2003 results no longer depend on the Unicode version...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2026:1791403199)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791403199 advisory. - The stringprep module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were use...

python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability

A flaw was found in the Python 'stringprep' module. This module incorrectly processed characters by using the latest Unicode codepoint attributes instead of the Unicode 3.2.0 standard specified in RFC 3454. This deviation can lead to mismatches when processing internationalized domain names IDNA...

Rocky Linux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789735614)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789735614 advisory. - When using the tarfile module with a file opened in streaming mode mode=r| the tarfile module did not properly handle EOF, makin...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789735614)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789735614 advisory. - When using the tarfile module with a file opened in streaming mode mode=r| the tarfile module did not properly handle EOF, making...

CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1789995979)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1789995979 advisory. - When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size t...

CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1789736914)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789736914 advisory. - When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to...

OESA-2026-4012 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2026-4011 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2026-4010 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2026-4009 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

CLSA-2026-1790155146 python3.11: Fix of 4 CVEs

CVE-2026-17084: use the Unicode 3.2.0 codepoint attributes required by RFC 3454 for the stringprep B.2/B.3 mappings instead of the running interpreter's, so IDNA 2003 encodes domain names consistently - CVE-2026-87910: skip the member in tarfile's link-extraction fallback when either filter call...

CLSA-2026-1790007232 python3: Fix of 4 CVEs

CVE-2026-87910: tarfile: skip a link member when the extraction filter returns None for its hardlink-extraction fallback instead of ignoring the filter result - CVE-2026-17084: stringprep: build the RFC 3454 B.2/B.3 tables from Unicode 3.2.0 data so IDNA 2003 encoding of newly case-folding...