RHSA-2026:19177

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used.

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Mitgation of CVE-2026-4519 was incomplete.

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete.

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages.

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files.

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.