Red Hat Security Advisory

RHSA-2026:68309

Red Hat Hardened Images RPMs Security Update

Released 2026-09-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images python3.13-3.13.15-1.3.hum1@aarch64, python3.13-3.13.15-1.3.hum1@src, python3.13-3.13.15-1.3.hum1@x86_64 +16

Fixes 6 records

TI-2026-56615 CVE-2026-82049 · GHSA-ghff-gcpf-9r9p

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

LOW 38

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00188 Published 2026-09-14 Fixed in 3.10.22, 3.11.17 +3 CWE-59

TI-2026-08483 CVE-2026-9669 · GHSA-8jvr-397x-xqh9

bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow

LOW 36

bz2.BZ2Decompressor objects could be reused after a decompression error.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00428 Published 2026-06-08 Partial fix · 3.10.21, 3.11.16 +4 CWE-121

TI-2026-06328 CVE-2026-7210 · GHSA-wxv8-w48j-r2f4

The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

LOW 29

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requir…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00672 Published 2026-05-11 Partial fix · 3.10.22, 3.11.16 +4 CWE-331

TI-2026-02828 CVE-2026-3276 · GHSA-jg6j-874m-wgjj

Potential DoS via quadratic complexity in unicodedata.normalize()

LOW 29

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00486 Published 2026-06-03 Partial fix · 3.10.21, 3.11.16 +4 CWE-407

TI-2026-07333 CVE-2026-8328 · GHSA-j989-fggp-qgp5

FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

LOW 27

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed.

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.00457 Published 2026-05-13 Fixed in 3.10.21, 3.11.16 +4 CWE-918

TI-2026-10345 CVE-2026-12003 · GHSA-2wqx-fp26-qh5v

CPython >3.11 Insecure Input Validation resulting in privilege escalation

LOW 25

To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local.

CVSS 4.0MEDIUM 5.3 Local Low privileges User interaction EPSS 0.00142 Published 2026-06-16 Partial fix · 3.11.16, 3.12.14 +3 CWE-427