Red Hat Security AdvisoryRHSA-2026:57660
Red Hat Hardened Images RPMs Security Update
Released 2026-08-20 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Hardened Images python3.11-3.11.16-1.hum1@aarch64, python3.11-3.11.16-1.hum1@src, python3.11-3.11.16-1.hum1@x86_64 +12
Fixes 3 records
Priority LOW 11
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
CVSS 4.0LOW 2.4· Local · Low privileges · User interaction · EPSS 0.00119 · Published 2026-08-10 · Partial fix · 3.10.21, 3.11.16 +5 CWE-1176
Priority LOW 11
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context.
CVSS 4.0LOW 2.1· Network · High privileges · No interaction · EPSS 0.00211 · Published 2026-04-22 · Partial fix · 3.13.14, 3.14.5rc1 +1 CWE-150
Priority LOW 2
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open().
CVSS 4.0N/A 0.0· Physical · No auth · No interaction · EPSS 0.00253 · Published 2026-03-18 · Partial fix · 3.13.13, 3.14.4 +1 CWE-22
