Astra Linux – Vulnerability in Python 3.11, Python 3.7

When loading a plist file, the plistlib module reads data in a size specified by the file itself. This means that a malicious file can cause out-of-memory OOM and denial-of-service DoS issues...

Astra Linux – Vulnerability in Python 3.11, Python 3.7

The poplib module, when a user-controlled command is passed to it, can have additional commands injected using newlines. Mitigation rejects commands that contain control characters...

Astra Linux – Vulnerability in Python 3.11

It allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory, and modifying some file metadata. This vulnerability affects users who use the TarFile module to extract untrusted tar archives using TarFile.extractall or TarFile.extract, with the...

ROOT-OS-DEBIAN-12-CVE-2026-11972 CVE-2026-11972 in python3.11 - Patched by Root

Root has patched CVE-2026-11972 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-4360 CVE-2026-4360 in python3.11 - Patched by Root

Root has patched CVE-2026-4360 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-0864 CVE-2026-0864 in python3.11 - Patched by Root

Root has patched CVE-2026-0864 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...

OESA-2026-3236 python-Keras security update

Keras is a high-level neural networks API for Python. Security Fixes: Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in keras/src/utils/fileutils.py. The functions filtersafetarinfos and filtersafezipinfos validate archive membe...

GHSA-M2H6-J472-RP4C vulnerabilities

Vulnerabilities for packages: openstack-glance-2026.1, datadog-agent-fips, openstack-nova-2026.1, openstack-nova-2025.1, apache-beam-python-3.12-sdk, mlflow, openstack-glance-2025.2, apache-beam-python-3.11-sdk, vllm-openai-cuda-13.0, openstack-glance-2025.1, dbt-snowflake, vllm-openai-cuda-12.9,...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1998)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1998 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated...

Important: python3.11

Issue Overview: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 In the...

EUVD-2026-43956

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs...

SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3132-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3132-1 advisory. This update for python311 fixes the following issues - CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers ...

Security Bulletin: Vulnerability in python (CVE-2026-45186) affects AIX/VIOS.

Summary Denial of service via moderately sized crafted XML input. Vulnerability Details CVEID:CVE-2026-45186 DESCRIPTION: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. CWE:CWE-407:...

DEBIAN-CVE-2026-12482

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filtersafetarinfos validation in keras/src/utils/fileutils.py. Specifically, symlink entries are not subjected to the same ispathindir validation as regular file entries,...

PT-2026-57960

Name of the Vulnerable Software and Affected Versions keras-team/keras version 3.12.0 Description An issue exists in keras/src/utils/file utils.py where the filter safe tarinfos validation is bypassed when processing malicious tar archives. Symlink entries do not undergo the same is path in dir...

PYSEC-2026-1840 Pyramid static view path traversal up one directory

Impact This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be...

Important: python3.11

Issue Overview: The "tarfile" module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.11: python3.11-3.11.15-4.4.hum1 aarch64, x8664 python3.11-debug-3.11.15-4.4.hum1 aarch64, x8664 python3.11-devel-3.11.15-4.4.hum1 aarch64, x8664 python3.11-idle-3.11.15-4.4.hum1 aarch64,...

python3.11 security update

3.11.13-10.0.1 - Remove upstream URL reference Orabug: 36073032 3.11.13-10 - Depend on sqlite-libs with deserialize API Resolves: RHEL-178519...

Astra Linux – Vulnerability in Python 3.11

The email module, specifically the “BytesGenerator” class, did not properly quote newlines for email headers when serializing an email message. This issue occurs only when using “LiteralHeader” to write headers that do not follow email folding rules. The new behavior will reject incorrectly folde...