TI-2026-08483 CVE-2026-9669 · GHSA-8jvr-397x-xqh9
bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
Priority LOW 36
bz2.BZ2Decompressor objects could be reused after a decompression error.
RHSA-2026:67572
Red Hat Hardened Images RPMs Security Update
Released 2026-09-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images python-unversioned-command-3.14.7-1.2.hum1@noarch@public-hummingbird-aarch64-rpms, python-unversioned-command-3.14.7-1.2.hum1@noarch@public-hummingbird-x86_64-rpms, python3-3.14.7-1.2.hum1@aarch64 +28
Fixes 6 records
TI-2026-06328 CVE-2026-7210 · GHSA-wxv8-w48j-r2f4
The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
Priority LOW 29
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requir…
TI-2026-02828 CVE-2026-3276 · GHSA-jg6j-874m-wgjj
Potential DoS via quadratic complexity in unicodedata.normalize()
Priority LOW 29
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values.
TI-2026-59977 CVE-2026-87910 · GHSA-rj44-3777-mh5x
tarfile hardlink fallback ignores custom extraction filter rejection via None
Priority LOW 27
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.
TI-2026-07333 CVE-2026-8328 · GHSA-j989-fggp-qgp5
FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
Priority LOW 27
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed.
TI-2026-10345 CVE-2026-12003 · GHSA-2wqx-fp26-qh5v
CPython >3.11 Insecure Input Validation resulting in privilege escalation
Priority LOW 25
To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local.