Read the docs
TI-2026-03926 Aliases CVE-2026-4519GHSA-rm92-fj5q-mpj5

webbrowser.open() allows leading dashes in URLs

Priority LOW 33CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0032 25th percentileScored 2026-11-07
Fix Fixed CPython (Python Software Foundation): 3.10.21, 3.11.16, 3.12.14 +3Red Hat: 52 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Python Software FoundationCPythonbefore 3.10.21; 3.11.0 to before 3.11.16; 3.12.0 to before 3.12.14; 3.13.0 to before 3.13.13; 3.14.0 to before 3.14.4; 3.15.0a1 to before 3.15.0a83.10.21, 3.11.16, 3.12.14, 3.13.13, 3.14.4, 3.15.0a8Patch availableCNA
  • CPython VendorPython Software Foundation Affected before 3.10.21; 3.11.0 to before 3.11.16; 3.12.0 to before 3.12.14; 3.13.0 to before 3.13.13; 3.14.0 to before 3.14.4; 3.15.0a1 to before 3.15.0a8 Fixed in 3.10.21, 3.11.16, 3.12.14, 3.13.13, 3.14.4, 3.15.0a8 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*before 3.13.13; 3.14.0 to before 3.14.4Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*3.15.0 alpha1Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*3.15.0 alpha2Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*3.15.0 alpha3Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*3.15.0 alpha4Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*3.15.0 alpha5Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*3.15.0 alpha6Vulnerablepython-pillow
cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*3.15.0 alpha7Vulnerablepython-pillow
  • cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions before 3.13.13; 3.14.0 to before 3.14.4 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:* Versions 3.15.0 alpha1 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:* Versions 3.15.0 alpha2 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:* Versions 3.15.0 alpha3 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:* Versions 3.15.0 alpha4 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:* Versions 3.15.0 alpha5 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:* Versions 3.15.0 alpha6 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:* Versions 3.15.0 alpha7 Vulnerable ·python-pillow

Remediation

  • Fix · CNA CPython (Python Software Foundation) Fixed in 3.10.21, 3.11.16, 3.12.14, 3.13.13, 3.14.4, 3.15.0a8

Red Hat 52 advisories

  • RHSA-2026:25096 Released 2026-06-10 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (cuda)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:21275 Released 2026-05-27 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.1 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:19725 Released 2026-05-20 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
Show 49 more Red Hat advisories
  • RHSA-2026:19724 Released 2026-05-20 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:19216 Released 2026-05-19 · Red Hat rating Important
    python3.9 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.25-7.el9_8, python3-devel-3.9.25-7.el9_8, python3-tkinter-3.9.25-7.el9_8
    • Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.25-7.el9_8, python3-libs-3.9.25-7.el9_8, python3.9-3.9.25-7.el9_8
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3-3.9.25-7.el9_8, python3-debug-3.9.25-7.el9_8, python3-idle-3.9.25-7.el9_8 +2
  • RHSA-2026:19176 Released 2026-05-19 · Red Hat rating Important
    python3.14 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.14-3.14.4-2.el9_8, python3.14-devel-3.14.4-2.el9_8, python3.14-libs-3.14.4-2.el9_8 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.14-3.14.4-2.el9_8, python3.14-debug-3.14.4-2.el9_8, python3.14-freethreading-3.14.4-2.el9_8 +9
  • RHSA-2026:19177 Released 2026-05-19 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-3.12.13-2.el9_8, python3.12-devel-3.12.13-2.el9_8, python3.12-libs-3.12.13-2.el9_8 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.12-3.12.13-2.el9_8, python3.12-debug-3.12.13-2.el9_8, python3.12-idle-3.12.13-2.el9_8 +2
  • RHSA-2026:19175 Released 2026-05-19 · Red Hat rating Important
    python3.11 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.11-3.11.13-9.el9_8, python3.11-devel-3.11.13-9.el9_8, python3.11-libs-3.11.13-9.el9_8 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.11-3.11.13-9.el9_8, python3.11-debug-3.11.13-9.el9_8, python3.11-idle-3.11.13-9.el9_8 +2
  • RHSA-2026:19064 Released 2026-05-19 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python-unversioned-command-3.12.13-2.el10_2, python3-devel-3.12.13-2.el10_2, python3-tkinter-3.12.13-2.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) python3-3.12.13-2.el10_2, python3-libs-3.12.13-2.el10_2, python3.12-3.12.13-2.el10_2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-debug-3.12.13-2.el10_2, python3-idle-3.12.13-2.el10_2, python3-test-3.12.13-2.el10_2
  • RHSA-2026:19019 Released 2026-05-19 · Red Hat rating Important
    python3.14 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python3.14-3.14.4-2.el10_2, python3.14-devel-3.14.4-2.el10_2, python3.14-libs-3.14.4-2.el10_2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3.14-debug-3.14.4-2.el10_2, python3.14-freethreading-3.14.4-2.el10_2, python3.14-freethreading-debug-3.14.4-2.el10_2 +7
  • RHSA-2026:16174 Released 2026-05-12 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.3 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:16030 Released 2026-05-11 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.3 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:16009 Released 2026-05-11 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.3 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:16008 Released 2026-05-11 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.3 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:13812 Released 2026-05-05 · Red Hat rating Important
    updated RHEL-8 based Middleware Containers container images
    • Middleware Containers for OpenShift rhpam-7/rhpam-businesscentral-monitoring-rhel8, rhpam-7/rhpam-businesscentral-rhel8, rhpam-7/rhpam-controller-rhel8 +4
  • RHSA-2026:10111 Released 2026-04-23 · Red Hat rating Important
    python3.12 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) python3.12-3.12.1-4.el9_4.12, python3.12-debug-3.12.1-4.el9_4.12, python3.12-idle-3.12.1-4.el9_4.12 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.12-3.12.1-4.el9_4.12, python3.12-devel-3.12.1-4.el9_4.12, python3.12-libs-3.12.1-4.el9_4.12 +1
  • RHSA-2026:10101 Released 2026-04-23 · Red Hat rating Important
    python3.9 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) python3-3.9.18-3.el9_4.12, python3-debug-3.9.18-3.el9_4.12, python3-idle-3.9.18-3.el9_4.12 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python-unversioned-command-3.9.18-3.el9_4.12, python3-devel-3.9.18-3.el9_4.12, python3-tkinter-3.9.18-3.el9_4.12
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) python3-3.9.18-3.el9_4.12, python3-libs-3.9.18-3.el9_4.12, python3.9-3.9.18-3.el9_4.12
  • RHSA-2026:10102 Released 2026-04-23 · Red Hat rating Important
    python security update
    • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) python-2.6.6-70.el6_10.3, python-devel-2.6.6-70.el6_10.3, python-libs-2.6.6-70.el6_10.3 +1
    • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) python-test-2.6.6-70.el6_10.3, python-tools-2.6.6-70.el6_10.3, tkinter-2.6.6-70.el6_10.3
  • RHSA-2026:10141 Released 2026-04-23 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.1
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:10140 Released 2026-04-23 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.1
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:10065 Released 2026-04-23 · Red Hat rating Important
    Red Hat Update Infrastructure 5.1 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:9745 Released 2026-04-22 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) python3-3.6.8-21.el7_9.5, python3-libs-3.6.8-21.el7_9.5, python3-libs-3.6.8-21.el7_9.5.ppc
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) python3-3.6.8-21.el7_9.5, python3-3.6.8-21.el7_9.5.ppc, python3-debug-3.6.8-21.el7_9.5 +9
  • RHSA-2026:9705 Released 2026-04-22 · Red Hat rating Important
    python3.11 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) python3.11-3.11.11-2.el9_6.6, python3.11-debug-3.11.11-2.el9_6.6, python3.11-idle-3.11.11-2.el9_6.6 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python3.11-3.11.11-2.el9_6.6, python3.11-devel-3.11.11-2.el9_6.6, python3.11-libs-3.11.11-2.el9_6.6 +1
  • RHSA-2026:9621 Released 2026-04-22 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) platform-python-3.6.8-39.el8_4.10, platform-python-debug-3.6.8-39.el8_4.10, platform-python-devel-3.6.8-39.el8_4.10 +3
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.10, platform-python-debug-3.6.8-39.el8_4.10, platform-python-devel-3.6.8-39.el8_4.10 +3
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) platform-python-3.6.8-39.el8_4.10, python3-3.6.8-39.el8_4.10, python3-libs-3.6.8-39.el8_4.10 +1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.10, python3-3.6.8-39.el8_4.10, python3-libs-3.6.8-39.el8_4.10 +1
  • RHSA-2026:9614 Released 2026-04-22 · Red Hat rating Important
    python security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) python-2.7.5-94.el7_9.4, python-devel-2.7.5-94.el7_9.4, python-libs-2.7.5-94.el7_9.4 +1
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) python-debug-2.7.5-94.el7_9.4, python-test-2.7.5-94.el7_9.4, python-tools-2.7.5-94.el7_9.4 +1
  • RHSA-2026:9591 Released 2026-04-22 · Red Hat rating Important
    python3.11 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) python3.11-3.11.2-2.el8_8.9, python3.11-devel-3.11.2-2.el8_8.9, python3.11-libs-3.11.2-2.el8_8.9 +2
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) python3.11-3.11.2-2.el8_8.9, python3.11-devel-3.11.2-2.el8_8.9, python3.11-libs-3.11.2-2.el8_8.9 +2
  • RHSA-2026:9386 Released 2026-04-21 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) platform-python-3.6.8-47.el8_6.12, platform-python-debug-3.6.8-47.el8_6.12, platform-python-devel-3.6.8-47.el8_6.12 +3
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) platform-python-3.6.8-47.el8_6.12, platform-python-debug-3.6.8-47.el8_6.12, platform-python-devel-3.6.8-47.el8_6.12 +3
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) platform-python-3.6.8-47.el8_6.12, platform-python-debug-3.6.8-47.el8_6.12, platform-python-devel-3.6.8-47.el8_6.12 +3
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) platform-python-3.6.8-47.el8_6.12, python3-3.6.8-47.el8_6.12, python3-libs-3.6.8-47.el8_6.12 +1
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) platform-python-3.6.8-47.el8_6.12, python3-3.6.8-47.el8_6.12, python3-libs-3.6.8-47.el8_6.12 +1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) platform-python-3.6.8-47.el8_6.12, python3-3.6.8-47.el8_6.12, python3-libs-3.6.8-47.el8_6.12 +1
  • RHSA-2026:9387 Released 2026-04-21 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) platform-python-3.6.8-24.el8_2.7, platform-python-debug-3.6.8-24.el8_2.7, platform-python-devel-3.6.8-24.el8_2.7 +3
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) platform-python-3.6.8-24.el8_2.7, python3-3.6.8-24.el8_2.7, python3-libs-3.6.8-24.el8_2.7 +1
  • RHSA-2026:9354 Released 2026-04-21 · Red Hat rating Important
    python3.9 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) python3-3.9.21-2.el9_6.5, python3-debug-3.9.21-2.el9_6.5, python3-idle-3.9.21-2.el9_6.5 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python-unversioned-command-3.9.21-2.el9_6.5, python3-devel-3.9.21-2.el9_6.5, python3-tkinter-3.9.21-2.el9_6.5
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) python3-3.9.21-2.el9_6.5, python3-libs-3.9.21-2.el9_6.5, python3.9-3.9.21-2.el9_6.5
  • RHSA-2026:9289 Released 2026-04-21 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) platform-python-3.6.8-51.el8_8.14, platform-python-debug-3.6.8-51.el8_8.14, platform-python-devel-3.6.8-51.el8_8.14 +3
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) platform-python-3.6.8-51.el8_8.14, platform-python-debug-3.6.8-51.el8_8.14, platform-python-devel-3.6.8-51.el8_8.14 +3
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) platform-python-3.6.8-51.el8_8.14, python3-3.6.8-51.el8_8.14, python3-libs-3.6.8-51.el8_8.14 +1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) platform-python-3.6.8-51.el8_8.14, python3-3.6.8-51.el8_8.14, python3-libs-3.6.8-51.el8_8.14 +1
  • RHSA-2026:9262 Released 2026-04-21 · Red Hat rating Important
    python3.9 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) python-unversioned-command-3.9.16-1.el9_2.13, python3-devel-3.9.16-1.el9_2.13, python3-tkinter-3.9.16-1.el9_2.13
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) python3-3.9.16-1.el9_2.13, python3-libs-3.9.16-1.el9_2.13, python3.9-3.9.16-1.el9_2.13
  • RHSA-2026:9260 Released 2026-04-21 · Red Hat rating Important
    python3.11 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) python3.11-3.11.2-2.el9_2.11, python3.11-devel-3.11.2-2.el9_2.11, python3.11-libs-3.11.2-2.el9_2.11 +1
  • RHSA-2026:9261 Released 2026-04-21 · Red Hat rating Important
    python3.9 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) python-unversioned-command-3.9.10-4.el9_0.10, python3-devel-3.9.10-4.el9_0.10, python3-tkinter-3.9.10-4.el9_0.10
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) python3-3.9.10-4.el9_0.10, python3-libs-3.9.10-4.el9_0.10, python3.9-3.9.10-4.el9_0.10
  • RHSA-2026:9042 Released 2026-04-20 · Red Hat rating Important
    python3.11 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) python3.11-3.11.7-1.el9_4.12, python3.11-debug-3.11.7-1.el9_4.12, python3.11-idle-3.11.7-1.el9_4.12 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.11-3.11.7-1.el9_4.12, python3.11-devel-3.11.7-1.el9_4.12, python3.11-libs-3.11.7-1.el9_4.12 +1
  • RHSA-2026:8748 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:8746 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:8747 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:7661 Released 2026-04-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-unversioned-command-3.14.4-1.hum1@noarch@public-hummingbird-aarch64-rpms, python-unversioned-command-3.14.4-1.hum1@noarch@public-hummingbird-x86_64-rpms, python3-3.14.4-1.hum1@aarch64 +28
  • RHSA-2026:7443 Released 2026-04-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python3.13-3.13.13-1.hum1@aarch64, python3.13-3.13.13-1.hum1@src, python3.13-3.13.13-1.hum1@x86_64 +16
  • RHSA-2026:7335 Released 2026-04-09 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:7329 Released 2026-04-09 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:7244 Released 2026-04-09 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) python-unversioned-command-3.12.9-2.el10_0.8, python3-devel-3.12.9-2.el10_0.8, python3-tkinter-3.12.9-2.el10_0.8
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) python3-3.12.9-2.el10_0.8, python3-libs-3.12.9-2.el10_0.8, python3.12-3.12.9-2.el10_0.8
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) python3-debug-3.12.9-2.el10_0.8, python3-idle-3.12.9-2.el10_0.8, python3-test-3.12.9-2.el10_0.8
  • RHSA-2026:7010 Released 2026-04-08 · Red Hat rating Important
    python3.12 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) python3.12-3.12.9-1.el9_6.7, python3.12-debug-3.12.9-1.el9_6.7, python3.12-idle-3.12.9-1.el9_6.7 +2
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python3.12-3.12.9-1.el9_6.7, python3.12-devel-3.12.9-1.el9_6.7, python3.12-libs-3.12.9-1.el9_6.7 +1
  • RHSA-2026:6766 Released 2026-04-07 · Red Hat rating Important
    python3.9 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.25-3.el9_7.2, python3-devel-3.9.25-3.el9_7.2, python3-tkinter-3.9.25-3.el9_7.2
    • Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.25-3.el9_7.2, python3-libs-3.9.25-3.el9_7.2, python3.9-3.9.25-3.el9_7.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3-3.9.25-3.el9_7.2, python3-debug-3.9.25-3.el9_7.2, python3-idle-3.9.25-3.el9_7.2 +2
  • RHSA-2026:6473 Released 2026-04-02 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-75.el8_10, platform-python-debug-3.6.8-75.el8_10, platform-python-devel-3.6.8-75.el8_10 +3
    • Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-75.el8_10, python3-3.6.8-75.el8_10, python3-libs-3.6.8-75.el8_10 +1
  • RHSA-2026:6285 Released 2026-03-31 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-3.12.12-4.el9_7.2, python3.12-devel-3.12.12-4.el9_7.2, python3.12-libs-3.12.12-4.el9_7.2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.12-3.12.12-4.el9_7.2, python3.12-debug-3.12.12-4.el9_7.2, python3.12-idle-3.12.12-4.el9_7.2 +2
  • RHSA-2026:6286 Released 2026-03-31 · Red Hat rating Important
    python3.11 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.11-3.11.13-5.2.el9_7, python3.11-devel-3.11.13-5.2.el9_7, python3.11-libs-3.11.13-5.2.el9_7 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.11-3.11.13-5.2.el9_7, python3.11-debug-3.11.13-5.2.el9_7, python3.11-idle-3.11.13-5.2.el9_7 +2
  • RHSA-2026:6283 Released 2026-03-31 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-3.12.12-4.el8_10, python3.12-devel-3.12.12-4.el8_10, python3.12-libs-3.12.12-4.el8_10 +2
    • Red Hat Enterprise Linux CRB (v. 8) python3.12-3.12.12-4.el8_10, python3.12-debug-3.12.12-4.el8_10, python3.12-idle-3.12.12-4.el8_10 +2
  • RHSA-2026:6281 Released 2026-03-31 · Red Hat rating Important
    python3.11 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.11-3.11.13-6.el8_10, python3.11-devel-3.11.13-6.el8_10, python3.11-libs-3.11.13-6.el8_10 +2
    • Red Hat Enterprise Linux CRB (v. 8) python3.11-3.11.13-6.el8_10, python3.11-debug-3.11.13-6.el8_10, python3.11-idle-3.11.13-6.el8_10 +2
  • RHSA-2026:6256 Released 2026-03-31 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python-unversioned-command-3.12.12-3.el10_1.2, python3-devel-3.12.12-3.el10_1.2, python3-tkinter-3.12.12-3.el10_1.2
    • Red Hat Enterprise Linux BaseOS (v. 10) python3-3.12.12-3.el10_1.2, python3-libs-3.12.12-3.el10_1.2, python3.12-3.12.12-3.el10_1.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-debug-3.12.12-3.el10_1.2, python3-idle-3.12.12-3.el10_1.2, python3-test-3.12.12-3.el10_1.2
  • RHSA-2026:6035 Released 2026-03-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python3.12-3.12.13-2.hum1@aarch64, python3.12-3.12.13-2.hum1@src, python3.12-3.12.13-2.hum1@x86_64 +12
  • RHSA-2026:6016 Released 2026-03-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python3.11-3.11.15-2.hum1@aarch64, python3.11-3.11.15-2.hum1@src, python3.11-3.11.15-2.hum1@x86_64 +12

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Middleware Containers for OpenShiftFixed RHSA-2026:13812
Red Hat AI Inference Server 3.2Fixed RHSA-2026:19724, RHSA-2026:19725, RHSA-2026:25096, RHSA-2026:7335
Red Hat AI Inference Server 3.3Fixed RHSA-2026:16008, RHSA-2026:16009, RHSA-2026:16030, RHSA-2026:16174, RHSA-2026:8746, RHSA-2026:8747, RHSA-2026:8748
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:10101, RHSA-2026:10111, RHSA-2026:9042
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:7010, RHSA-2026:9354, RHSA-2026:9705
Red Hat Discovery 2Fixed RHSA-2026:7329
Red Hat Enterprise Linux AI 3.3Fixed RHSA-2026:10140, RHSA-2026:10141
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:19019, RHSA-2026:19064, RHSA-2026:6256
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:6281, RHSA-2026:6283, RHSA-2026:6473
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:19175, RHSA-2026:19176, RHSA-2026:19177, RHSA-2026:19216, RHSA-2026:6285, RHSA-2026:6286, RHSA-2026:6766
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:9387
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:9621
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:9386
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:9386
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:9289, RHSA-2026:9591
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:9261
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:9260, RHSA-2026:9262
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:7244
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:10101, RHSA-2026:10111, RHSA-2026:9042
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:7010, RHSA-2026:9354, RHSA-2026:9705
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:9621
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:9386
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:9289, RHSA-2026:9591
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:19064, RHSA-2026:6256
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:6473
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:19216, RHSA-2026:6766
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2026:9387
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:9621
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:9386
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:9386
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:9289
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:9261
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:9262
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:7244
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:10101
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:9354
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:9621
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:9386
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:9289
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:6281, RHSA-2026:6283
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:19019, RHSA-2026:19064, RHSA-2026:6256
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:19175, RHSA-2026:19176, RHSA-2026:19177, RHSA-2026:19216, RHSA-2026:6285, RHSA-2026:6286, RHSA-2026:6766
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:7244
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:9614, RHSA-2026:9745
Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)Fixed RHSA-2026:10102
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:9614, RHSA-2026:9745
Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)Fixed RHSA-2026:10102
Red Hat Hardened ImagesFixed RHSA-2026:6016, RHSA-2026:6035, RHSA-2026:7443, RHSA-2026:7661
Red Hat Update Infrastructure 5Fixed RHSA-2026:10065, RHSA-2026:21275
Not affected: 3 products
  • Middleware Containers for OpenShift
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4519
  2. 2026-10-03 Alias added: GHSA-rm92-fj5q-mpj5

References

Patch 14

Advisory 2

  • TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
  • TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
  • TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
  • TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
  • TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
  • TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences