Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-cryptography: python3-cryptography-50.0.0-1.hum1 aarch64, x8664 python-cryptography-50.0.0-1.hum1.src src...

python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

A flaw was found in python-cryptography versions 46.0.6 through 48.x. The X.509 verifier incorrectly handles wildcard DNS Subject Alternative Names when evaluating permitted name constraints: a leaf SAN such as .example.com may be accepted under a more specific permitted subtree for example...

BIT-PYTHON-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

BIT-PYTHON-MIN-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

BIT-PYTHON-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

BIT-LIBPYTHON-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion

There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware...

vim: Vim: Arbitrary code execution via Python omni-completion

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a...

K000162939: Python vulnerability CVE-2025-13836

Security Advisory Description When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS...

ROS-20260817-73-0211

The vulnerability in python-setuptools is related to incorrect data processing based on the Unicode encoding standard. Exploiting this vulnerability can allow a remote attacker to cause service failures...

ROS-20260817-73-0206

The vulnerability in python-PyPDF2 is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Medium: python-jwt

Issue Overview: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is...

PT-2026-76633

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0 Description A sandbox escape exists in the IsolatedPluginExecutor component that exposes Python type objects within restricted exec builtins. This allows attackers to traverse the Python class hierarchy...

uproot 5.7.4 TStreamerInfo Code Injection

uproot version 5.7.4 and prior contain a code injection vulnerability in the handling of ROOT TStreamerInfo metadata where attacker-controlled streamer fields are incorporated into dynamically generated Python source without sufficient quoting. A malicious ROOT file can therefore cause arbitrary...

PT-2026-76749

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description sqlparse contains an issue where the construction of TokenList and subsequent string conversion repeatedly flatten nested token subtrees. This occurs when processing SQL with deep nesting, such as...

CVE-2026-54284: Inefficient Algorithmic Complexity

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

PT-2026-76720

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description The sqlparse/filters/output.py module fails to escape existing backslashes before quotes when using output format='python' or output format='php' in the sqlparse.format function and the correspondin...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099501)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099501 advisory. An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.utils.cache.hasvaryheader in Django does not strip leading or trailing whitespace fr...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099457)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099457 advisory. An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated Content-Length header can bypass the...

Fedora 46 : python-tablib (2026-d69d02ea41)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d69d02ea41 advisory. Automatic update for python-tablib-3.10.0-1.fc46. Changelog Mon Aug 17 2026 Steve Traylen - 3.10.0-1 - Update to v3.10.0 CVE-2026-9318 - Resolves: rhbz251447...