Read the docs
TI-2026-01014 Aliases CVE-2026-1299GHSA-jh94-8q48-f3m3

email BytesGenerator header injection due to unquoted newlines

Priority LOW 28CWE-93Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · High · None
Fix status
Partial Red Hat: 45 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00573 47th percentileScored 2026-11-07
Fix Partial CPython (Python Software Foundation): 3.10.20, 3.11.15, 3.12.13 +3Red Hat: 33 advisoriesRed Hat: 45 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Python Software FoundationCPythonbefore 3.10.20; 3.11.0 to before 3.11.15; 3.12.0 to before 3.12.13; 3.13.0 to before 3.13.12; 3.14.0 to before 3.14.3; 3.15.0a1 to before 3.15.0a63.10.20, 3.11.15, 3.12.13, 3.13.12, 3.14.3, 3.15.0a6Patch availableCNA
  • CPython VendorPython Software Foundation Affected before 3.10.20; 3.11.0 to before 3.11.15; 3.12.0 to before 3.12.13; 3.13.0 to before 3.13.12; 3.14.0 to before 3.14.3; 3.15.0a1 to before 3.15.0a6 Fixed in 3.10.20, 3.11.15, 3.12.13, 3.13.12, 3.14.3, 3.15.0a6 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*——python-pillow
  • cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions — — ·python-pillow

Remediation

  • Fix · CNA CPython (Python Software Foundation) Fixed in 3.10.20, 3.11.15, 3.12.13, 3.13.12, 3.14.3, 3.15.0a6

Red Hat 33 advisories

  • RHSA-2026:16174 Released 2026-05-12 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.3 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:8824 Released 2026-04-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python3.12-3.12.13-3.hum1@aarch64, python3.12-3.12.13-3.hum1@src, python3.12-3.12.13-3.hum1@x86_64 +12
  • RHSA-2026:8822 Released 2026-04-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python3.11-3.11.15-4.hum1@aarch64, python3.11-3.11.15-4.hum1@src, python3.11-3.11.15-4.hum1@x86_64 +12
Show 30 more Red Hat advisories
  • RHSA-2026:8748 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:8746 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:8747 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:7661 Released 2026-04-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-unversioned-command-3.14.4-1.hum1@noarch@public-hummingbird-aarch64-rpms, python-unversioned-command-3.14.4-1.hum1@noarch@public-hummingbird-x86_64-rpms, python3-3.14.4-1.hum1@aarch64 +28
  • RHSA-2026:7443 Released 2026-04-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python3.13-3.13.13-1.hum1@aarch64, python3.13-3.13.13-1.hum1@src, python3.13-3.13.13-1.hum1@x86_64 +16
  • RHSA-2026:7329 Released 2026-04-09 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:6464 Released 2026-04-02 · Red Hat rating Moderate
    python3 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) python3-3.6.8-21.el7_9.4, python3-libs-3.6.8-21.el7_9.4, python3-libs-3.6.8-21.el7_9.4.ppc
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) python3-3.6.8-21.el7_9.4, python3-3.6.8-21.el7_9.4.ppc, python3-debug-3.6.8-21.el7_9.4 +9
  • RHSA-2026:6253 Released 2026-03-31 · Red Hat rating Moderate
    python3.11 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) python3.11-3.11.7-1.el9_4.11, python3.11-debug-3.11.7-1.el9_4.11, python3.11-idle-3.11.7-1.el9_4.11 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.11-3.11.7-1.el9_4.11, python3.11-devel-3.11.7-1.el9_4.11, python3.11-libs-3.11.7-1.el9_4.11 +1
  • RHSA-2026:6008 Released 2026-03-30 · Red Hat rating Moderate
    python3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) platform-python-3.6.8-51.el8_8.13, platform-python-debug-3.6.8-51.el8_8.13, platform-python-devel-3.6.8-51.el8_8.13 +3
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) platform-python-3.6.8-51.el8_8.13, platform-python-debug-3.6.8-51.el8_8.13, platform-python-devel-3.6.8-51.el8_8.13 +3
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) platform-python-3.6.8-51.el8_8.13, python3-3.6.8-51.el8_8.13, python3-libs-3.6.8-51.el8_8.13 +1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) platform-python-3.6.8-51.el8_8.13, python3-3.6.8-51.el8_8.13, python3-libs-3.6.8-51.el8_8.13 +1
  • RHSA-2026:5606 Released 2026-03-24 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:5399 Released 2026-03-23 · Red Hat rating Moderate
    python3.12 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) python3.12-3.12.1-4.el9_4.11, python3.12-debug-3.12.1-4.el9_4.11, python3.12-idle-3.12.1-4.el9_4.11 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.12-3.12.1-4.el9_4.11, python3.12-devel-3.12.1-4.el9_4.11, python3.12-libs-3.12.1-4.el9_4.11 +1
  • RHSA-2026:5315 Released 2026-03-23 · Red Hat rating Moderate
    python3.12 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) python-unversioned-command-3.12.9-2.el10_0.7, python3-devel-3.12.9-2.el10_0.7, python3-tkinter-3.12.9-2.el10_0.7
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) python3-3.12.9-2.el10_0.7, python3-libs-3.12.9-2.el10_0.7, python3.12-3.12.9-2.el10_0.7
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) python3-debug-3.12.9-2.el10_0.7, python3-idle-3.12.9-2.el10_0.7, python3-test-3.12.9-2.el10_0.7
  • RHSA-2026:5226 Released 2026-03-23 · Red Hat rating Moderate
    python3.9 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) python3-3.9.18-3.el9_4.11, python3-debug-3.9.18-3.el9_4.11, python3-idle-3.9.18-3.el9_4.11 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python-unversioned-command-3.9.18-3.el9_4.11, python3-devel-3.9.18-3.el9_4.11, python3-tkinter-3.9.18-3.el9_4.11
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) python3-3.9.18-3.el9_4.11, python3-libs-3.9.18-3.el9_4.11, python3.9-3.9.18-3.el9_4.11
  • RHSA-2026:5225 Released 2026-03-23 · Red Hat rating Moderate
    python3.9 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) python-unversioned-command-3.9.16-1.el9_2.12, python3-devel-3.9.16-1.el9_2.12, python3-tkinter-3.9.16-1.el9_2.12
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) python3-3.9.16-1.el9_2.12, python3-libs-3.9.16-1.el9_2.12, python3.9-3.9.16-1.el9_2.12
  • RHSA-2026:5218 Released 2026-03-23 · Red Hat rating Moderate
    python3.9 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) python3-3.9.21-2.el9_6.4, python3-debug-3.9.21-2.el9_6.4, python3-idle-3.9.21-2.el9_6.4 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python-unversioned-command-3.9.21-2.el9_6.4, python3-devel-3.9.21-2.el9_6.4, python3-tkinter-3.9.21-2.el9_6.4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) python3-3.9.21-2.el9_6.4, python3-libs-3.9.21-2.el9_6.4, python3.9-3.9.21-2.el9_6.4
  • RHSA-2026:5215 Released 2026-03-23 · Red Hat rating Moderate
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) platform-python-3.6.8-47.el8_6.11, platform-python-debug-3.6.8-47.el8_6.11, platform-python-devel-3.6.8-47.el8_6.11 +3
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) platform-python-3.6.8-47.el8_6.11, platform-python-debug-3.6.8-47.el8_6.11, platform-python-devel-3.6.8-47.el8_6.11 +3
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) platform-python-3.6.8-47.el8_6.11, platform-python-debug-3.6.8-47.el8_6.11, platform-python-devel-3.6.8-47.el8_6.11 +3
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) platform-python-3.6.8-47.el8_6.11, python3-3.6.8-47.el8_6.11, python3-libs-3.6.8-47.el8_6.11 +1
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) platform-python-3.6.8-47.el8_6.11, python3-3.6.8-47.el8_6.11, python3-libs-3.6.8-47.el8_6.11 +1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) platform-python-3.6.8-47.el8_6.11, python3-3.6.8-47.el8_6.11, python3-libs-3.6.8-47.el8_6.11 +1
  • RHSA-2026:5219 Released 2026-03-23 · Red Hat rating Moderate
    python3.9 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) python-unversioned-command-3.9.10-4.el9_0.9, python3-devel-3.9.10-4.el9_0.9, python3-tkinter-3.9.10-4.el9_0.9
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) python3-3.9.10-4.el9_0.9, python3-libs-3.9.10-4.el9_0.9, python3.9-3.9.10-4.el9_0.9
  • RHSA-2026:5223 Released 2026-03-23 · Red Hat rating Moderate
    python3.11 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) python3.11-3.11.2-2.el9_2.10, python3.11-devel-3.11.2-2.el9_2.10, python3.11-libs-3.11.2-2.el9_2.10 +1
  • RHSA-2026:5221 Released 2026-03-23 · Red Hat rating Moderate
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) platform-python-3.6.8-39.el8_4.9, platform-python-debug-3.6.8-39.el8_4.9, platform-python-devel-3.6.8-39.el8_4.9 +3
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.9, platform-python-debug-3.6.8-39.el8_4.9, platform-python-devel-3.6.8-39.el8_4.9 +3
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) platform-python-3.6.8-39.el8_4.9, python3-3.6.8-39.el8_4.9, python3-libs-3.6.8-39.el8_4.9 +1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.9, python3-3.6.8-39.el8_4.9, python3-libs-3.6.8-39.el8_4.9 +1
  • RHSA-2026:5216 Released 2026-03-23 · Red Hat rating Moderate
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) platform-python-3.6.8-24.el8_2.6, platform-python-debug-3.6.8-24.el8_2.6, platform-python-devel-3.6.8-24.el8_2.6 +3
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) platform-python-3.6.8-24.el8_2.6, python3-3.6.8-24.el8_2.6, python3-libs-3.6.8-24.el8_2.6 +1
  • RHSA-2026:5152 Released 2026-03-19 · Red Hat rating Moderate
    python3.11 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) python3.11-3.11.2-2.el8_8.8, python3.11-devel-3.11.2-2.el8_8.8, python3.11-libs-3.11.2-2.el8_8.8 +2
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) python3.11-3.11.2-2.el8_8.8, python3.11-devel-3.11.2-2.el8_8.8, python3.11-libs-3.11.2-2.el8_8.8 +2
  • RHSA-2026:4943 Released 2026-03-18 · Red Hat rating Important
    Red Hat Update Infrastructure 5.1 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:4746 Released 2026-03-17 · Red Hat rating Moderate
    python3.12 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) python3.12-3.12.9-1.el9_6.6, python3.12-debug-3.12.9-1.el9_6.6, python3.12-idle-3.12.9-1.el9_6.6 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python3.12-3.12.9-1.el9_6.6, python3.12-devel-3.12.9-1.el9_6.6, python3.12-libs-3.12.9-1.el9_6.6 +1
  • RHSA-2026:4713 Released 2026-03-17 · Red Hat rating Moderate
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python-unversioned-command-3.12.12-3.el10_1.1, python3-devel-3.12.12-3.el10_1.1, python3-tkinter-3.12.12-3.el10_1.1
    • Red Hat Enterprise Linux BaseOS (v. 10) python3-3.12.12-3.el10_1.1, python3-libs-3.12.12-3.el10_1.1, python3.12-3.12.12-3.el10_1.1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-debug-3.12.12-3.el10_1.1, python3-idle-3.12.12-3.el10_1.1, python3-test-3.12.12-3.el10_1.1
  • RHSA-2026:4473 Released 2026-03-12 · Red Hat rating Moderate
    python3.11 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.11-3.11.13-5.el8_10, python3.11-devel-3.11.13-5.el8_10, python3.11-libs-3.11.13-5.el8_10 +2
    • Red Hat Enterprise Linux CRB (v. 8) python3.11-3.11.13-5.el8_10, python3.11-debug-3.11.13-5.el8_10, python3.11-idle-3.11.13-5.el8_10 +2
  • RHSA-2026:4463 Released 2026-03-12 · Red Hat rating Moderate
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-3.12.12-3.el8_10, python3.12-devel-3.12.12-3.el8_10, python3.12-libs-3.12.12-3.el8_10 +2
    • Red Hat Enterprise Linux CRB (v. 8) python3.12-3.12.12-3.el8_10, python3.12-debug-3.12.12-3.el8_10, python3.12-idle-3.12.12-3.el8_10 +2
  • RHSA-2026:4216 Released 2026-03-10 · Red Hat rating Moderate
    python3.11 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.11-3.11.13-5.1.el9_7, python3.11-devel-3.11.13-5.1.el9_7, python3.11-libs-3.11.13-5.1.el9_7 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.11-3.11.13-5.1.el9_7, python3.11-debug-3.11.13-5.1.el9_7, python3.11-idle-3.11.13-5.1.el9_7 +2
  • RHSA-2026:4168 Released 2026-03-10 · Red Hat rating Moderate
    python3.9 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.25-3.el9_7.1, python3-devel-3.9.25-3.el9_7.1, python3-tkinter-3.9.25-3.el9_7.1
    • Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.25-3.el9_7.1, python3-libs-3.9.25-3.el9_7.1, python3.9-3.9.25-3.el9_7.1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3-3.9.25-3.el9_7.1, python3-debug-3.9.25-3.el9_7.1, python3-idle-3.9.25-3.el9_7.1 +2
  • RHSA-2026:4165 Released 2026-03-10 · Red Hat rating Moderate
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-3.12.12-4.el9_7.1, python3.12-devel-3.12.12-4.el9_7.1, python3.12-libs-3.12.12-4.el9_7.1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.12-3.12.12-4.el9_7.1, python3.12-debug-3.12.12-4.el9_7.1, python3.12-idle-3.12.12-4.el9_7.1 +2
  • RHSA-2026:2128 Released 2026-02-05 · Red Hat rating Moderate
    python3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-73.el8_10, platform-python-debug-3.6.8-73.el8_10, platform-python-devel-3.6.8-73.el8_10 +3
    • Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-73.el8_10, python3-3.6.8-73.el8_10, python3-libs-3.6.8-73.el8_10 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat AI Inference Server 3.3Fixed RHSA-2026:16174, RHSA-2026:8746, RHSA-2026:8747, RHSA-2026:8748
Red Hat Ceph Storage 8Fixed RHSA-2026:5606
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:5226, RHSA-2026:5399, RHSA-2026:6253
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:4746, RHSA-2026:5218
Red Hat Discovery 2Fixed RHSA-2026:7329
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:4713
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:2128, RHSA-2026:4463, RHSA-2026:4473
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:4165, RHSA-2026:4168, RHSA-2026:4216
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:5216
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:5221
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:5215
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:5215
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:5152, RHSA-2026:6008
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:5219
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:5223, RHSA-2026:5225
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:5315
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:5226, RHSA-2026:5399, RHSA-2026:6253
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:4746, RHSA-2026:5218
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:5221
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:5215
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:5152, RHSA-2026:6008
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:4713
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:2128
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:4168
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2026:5216
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:5221
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:5215
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:5215
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:6008
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:5219
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:5225
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:5315
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:5226
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:5218
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:5221
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:5215
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:6008
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:4463, RHSA-2026:4473
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:4713
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:4165, RHSA-2026:4168, RHSA-2026:4216
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:5315
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:6464
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:6464
Red Hat Hardened ImagesFixed RHSA-2026:7443, RHSA-2026:7661, RHSA-2026:8822, RHSA-2026:8824
Red Hat Update Infrastructure 5Fixed RHSA-2026:4943
Not affected: 7 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Dev Spaces

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1299
  2. 2026-10-03 Alias added: GHSA-jh94-8q48-f3m3

References

Patch 7

Advisory 1

Other 2

  • TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
  • TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
  • TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
  • TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
  • TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
  • TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences