Tuxcare Errata System 0.0.1 5.10 2026-08-12T17:22:55 Community Enterprise Operating System 9 - CVE-2023-24329: make urllib.parse.urlparse enforce that a scheme must begin with an alphabetical ASCII character - CVE-2023-40217: check for & avoid the ssl pre-close flaw - CVE-2024-6232: remove backtracking when parsing tarfile headers - CVE-2024-7592: fix quadratic complexity in parsing double-quoted cookie values with backslashes Important TuxCare License Agreement CVE-2023-24329 CVE-2024-9287 CVE-2024-6232 CVE-2022-45061 CVE-2023-27043 CVE-2023-40217 CVE-2021-28861 CVE-2024-7592 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2007-4559: implement PEP 706 - a filter in the tarfile module to prevent directory traversal vulnerability - CVE-2023-6597: prevent tempfile.TemporaryDirectory class dereference symlinks Important TuxCare License Agreement CVE-2007-4559 CVE-2023-6597 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2019-9674: add pitfalls to zipfile module documentation Important TuxCare License Agreement CVE-2019-9674 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-45061: fix quadratic time idna decoding - CVE-2019-9674: add pitfalls to zipfile module documentation Critical TuxCare License Agreement CVE-2024-7592 CVE-2024-6232 CVE-2023-24329 CVE-2019-9674 CVE-2022-48560 CVE-2022-48565 CVE-2022-45061 CVE-2022-0391 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-27043: reject malformed addresses in email.parseaddr() - CVE-2020-8492: fix regex in AbstractBasicAuthHandler - CVE-2021-3733: fix regex in AbstractBasicAuthHandler Moderate TuxCare License Agreement CVE-2020-8492 CVE-2022-48566 CVE-2023-40217 CVE-2021-3733 CVE-2023-27043 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2021-3737: stop reading a header if it's too long - CVE-2019-20907: avoid infinite loop in the tarfile module - Build and testing fixes in spec Important TuxCare License Agreement CVE-2019-20907 CVE-2021-3737 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2020-26116: prevent http header injection in httplib Important TuxCare License Agreement CVE-2020-26116 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - Fix CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517: fix multiple tarfile extraction filter bypasses (filter="tar"/filter="data") - fix test_tarfile.py Important TuxCare License Agreement CVE-2025-4435 CVE-2025-4330 CVE-2025-4138 CVE-2024-12718 CVE-2025-4517 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-13837: fix memory denial of service in plistlib Moderate TuxCare License Agreement CVE-2025-13837 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2015-20107: mailcap: sanitize the second argument which allowing shell commands injection Important TuxCare License Agreement CVE-2015-20107 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2015-20107: sanitize the second argument, which allows shell command injection in the mailcap module Important TuxCare License Agreement CVE-2015-20107 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-12084: remove quadratic behavior in xml.minidom node ID cache clearing Moderate TuxCare License Agreement CVE-2025-12084 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-6075: fix quadratic complexity in os.path.expandvars() Moderate TuxCare License Agreement CVE-2025-6075 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-8194: tarfile: validate archives to ensure member offsets are non-negative Important TuxCare License Agreement CVE-2025-8194 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-8194: tarfile: validate archives to ensure member offsets are non-negative Important TuxCare License Agreement CVE-2025-8194 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-6075: fix quadratic complexity in os.path.expandvars() Moderate TuxCare License Agreement CVE-2025-6075 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-4519: reject leading dashes in webbrowser.open() URLs to prevent command-line option injection in browser subprocesses Low TuxCare License Agreement CVE-2026-4519 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-4519: reject leading dashes in webbrowser.open() URLs to prevent command-line option injection in browser subprocesses Important TuxCare License Agreement CVE-2026-4519 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-0450: zipfile raises BadZipFile on quoted-overlap archive entries to prevent high-ratio zip bombs - CVE-2026-6100: use-after-free in lzma/bz2 decompressors when a MemoryError leaves a stale next_in pointer on a re-used decompressor Critical TuxCare License Agreement CVE-2026-6100 CVE-2024-0450 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-6100: NULL bzs->next_in in error paths in BZ2Decomp_decompress. Critical TuxCare License Agreement CVE-2026-6100 CVE-2020-27619 CVE-2024-0450 CVE-2021-3177 CVE-2021-4189 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-1299: email.Generator now rejects header *values* containing CR/LF that are not followed by folding whitespace by raising HeaderWriteError. In Python 2.7 (which lacks BytesGenerator) this single Generator-class hardening covers both upstream CVE-2026-1299 and CVE-2024-6923. - CVE-2024-6923: email.Generator now rejects header *names* containing CR/LF that are not followed by folding whitespace by raising HeaderWriteError, preventing header injection through the header name. - CVE-2024-0397: ssl.SSLContext.cert_store_stats and get_ca_certs now deep-copy the X509_STORE under X509_STORE_lock (via a backport of OpenSSL 3.3's X509_STORE_get1_objects), fixing a memory race when an SSLContext is shared across threads. - CVE-2021-28861: BaseHTTPServer now collapses any leading run of '/' in the request path to a single '/' to prevent an open-redirect via //evil.example/... URIs in 301 Location headers. Important TuxCare License Agreement CVE-2024-6923 CVE-2021-28861 CVE-2024-0397 CVE-2026-1299 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-1299: email.BytesGenerator now refuses to serialize headers that are unsafely folded or contain unfolded newlines, closing a header-injection bypass of CVE-2024-6923 (also includes the CVE-2024-6923 prerequisite hardening of the string Generator) - CVE-2024-0397: ssl.SSLContext.cert_store_stats() and get_ca_certs() now correctly lock the certificate store via a backported X509_STORE_get1_objects shim, fixing a memory race when an SSLContext is shared across threads - CVE-2024-4032: ipaddress is_private/is_global now classify addresses per the IANA special-purpose registries (192.0.0.0/24 with 192.0.0.9 and 192.0.0.10 exceptions, 64:ff9b:1::/48, 2002::/16, and the 2001::/23 sub-range exceptions) Important TuxCare License Agreement CVE-2024-4032 CVE-2024-0397 CVE-2026-1299 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-3446: binascii.a2b_base64 / base64.b64decode no longer abort the decoder loop on the first padded quad. The pad character is treated as non-alphabet data per RFC 4648 section 3.3, so excess data after the padding is decoded instead of being silently dropped. Moderate TuxCare License Agreement CVE-2026-3446 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-3446: binascii.a2b_base64 / base64.b64decode no longer abort the decoder loop on the first padded quad. The pad character is treated as non-alphabet data per RFC 4648 section 3.3, so excess data after the padding is decoded instead of being silently dropped. Moderate TuxCare License Agreement CVE-2026-3446 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-15282: urllib.request.DataHandler accepted data: URLs whose mediatype contained C0 control characters, allowing newline-based HTTP header injection downstream. Reject control characters in data_open(). - CVE-2026-0672: http.cookies.Morsel did not reject control characters in keys, values, or coded_value, allowing cookie injection via __setitem__, setdefault, set, and BaseCookie.output. Add a _has_control_character helper and validate in those entry points and BaseCookie.OutputString. - CVE-2026-3644: the CVE-2026-0672 fix was incomplete; control characters could still bypass via Morsel.update(), |=, __setstate__, and BaseCookie.js_output(). Validate those entry points too and re-validate the assembled output string in js_output(). - CVE-2026-4224: Modules/pyexpat.c conv_content_model could overflow the C stack when an Expat parser with a registered ElementDeclHandler parsed a deeply nested DTD content model, causing a denial-of-service. Wrap conv_content_model with Py_EnterRecursiveCall so deep nesting raises RecursionError instead of crashing. Moderate TuxCare License Agreement CVE-2025-15282 CVE-2026-3644 CVE-2026-4224 CVE-2026-0672 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-4224: Modules/pyexpat.c conv_content_model could overflow the C stack when an Expat parser with a registered ElementDeclHandler parsed a deeply nested DTD content model, causing a denial-of-service. Wrap conv_content_model with Py_EnterRecursiveCall so deep nesting raises RuntimeError instead of crashing. - CVE-2026-0672 + CVE-2026-3644: Lib/Cookie.py Morsel accepted control characters in reserved-attribute values, in key/value/coded_value via .set(), and via the inherited dict.update() / pickle restoration paths, allowing newline-based HTTP header injection via Set-Cookie. Add a _has_control_character helper and validate at Morsel.__setitem__, .setdefault, .set, an explicit .update, an explicit .__setstate__, plus re-validate the assembled output in Morsel.js_output and BaseCookie.output (defence-in-depth against direct attribute mutation). The py3 __ior__ hunk is not ported (py2 dict has no `|=` operator). Moderate TuxCare License Agreement CVE-2026-3644 CVE-2026-4224 CVE-2026-0672 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-7210 + CVE-2026-41080 (paired): backport libexpat 16-byte salt API (XML_SetHashSalt16Bytes) into bundled expat 2.4.1 and wire pyexpat/_elementtree to use it. Together these restore proper hash-flood mitigation for xml.parsers.expat and xml.etree.ElementTree. CVE-2026-7210 (cpython 24b8f12): xml.parsers.expat and xml.etree.ElementTree used insufficient entropy (a single Py_hash_t) for Expat hash-flooding protection. The cpython half of the fix seeds the parser with the full 16-byte _Py_HashSecret.expat.hashsalt16 via XML_SetHashSalt16Bytes when the libexpat being linked exposes that API. CVE-2026-41080 (libexpat PR #1183): libexpat's hash-flood protection itself only used 4-8 bytes of entropy for the SipHash salt. The libexpat half adds the new XML_SetHashSalt16Bytes API (and widens the parser's internal salt storage to a full struct sipkey) so the 16-byte path is available. Backported into the bundled libexpat 2.4.1 tree in Modules/expat/; the bundled expat.h now also defines XML_HAS_HASHSALT16BYTES_BACKPORT so the cpython 20800 gate activates against the patched bundle without bumping the advertised libexpat version. Alpine builds use --with-system-expat and are unaffected by the libexpat backport. Critical TuxCare License Agreement CVE-2026-7210 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-7210 + CVE-2026-41080 (paired): backport libexpat 16-byte salt API (XML_SetHashSalt16Bytes) into bundled expat 2.2.8 and wire pyexpat/_elementtree to use it. Together these restore proper hash-flood mitigation. * CVE-2026-7210 (cpython side, gh-149018 / 24b8f12): xml.parsers.expat and xml.etree.ElementTree used the legacy 8-byte XML_SetHashSalt API, which can be brute-forced to trigger hash collisions. Adds a hashsalt16[16] field to _Py_HashSecret_t in Include/object.h (seeded by _PyRandom_Init), exposes a NULL-able SetHashSalt16Bytes function pointer in the pyexpat CAPI struct, and prefers the new 16-byte API whenever XML_COMBINED_VERSION >= 20800. * CVE-2026-41080 (libexpat side, PR #1183): widens m_hash_secret_salt in the bundled libexpat 2.2.8 source tree (Modules/expat/) from `unsigned long` to a `struct sipkey` (128 bits) and adds the new public XML_SetHashSalt16Bytes() entry point. The bundled pyexpat.so / _elementtree.so are statically linked against this tree, so the cpython half can now consume full 16-byte entropy in every build configuration (no external libexpat >= 2.8.0 requirement). Critical TuxCare License Agreement CVE-2026-7210 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-13462: tarfile applied AREGTYPE -> DIRTYPE normalization even during multi-block GNU long members (LONGNAME / LONGLINK), enabling a parsing differential. Thread a dircheck flag through frombuf / fromtarfile so normalization is skipped on follow-up headers. - CVE-2026-0865: wsgiref.headers.Headers did not reject control characters in header names / values, allowing HTTP header injection from WSGI applications. Combined backport: gh-143917 adds the control-char regex check, gh-143916 HTAB follow-up splits the check so HTAB is allowed in header values (RFC 9110 Section 5.5) but still rejected in header names; LF / CR / DEL remain rejected in both. gh-144370 also disallows control characters in status in wsgiref.handlers. - CVE-2026-1502: http.client did not reject CR/LF in HTTPConnection CONNECT tunnel host / headers, enabling request injection. Validate the tunnel host and per-header name / value in _tunnel(). - CVE-2026-6019: http.cookies.Morsel.js_output() emitted an inline <script> snippet that only escaped " and left </script> intact, enabling HTML injection. Base64-encode the cookie value in the emitted JavaScript (gh-90309). Moderate TuxCare License Agreement CVE-2025-4516 CVE-2025-13462 CVE-2026-1502 CVE-2024-50602 CVE-2024-11168 CVE-2026-0865 CVE-2025-8291 CVE-2025-6069 CVE-2025-1795 CVE-2025-0938 CVE-2026-6019 CVE-2025-11468 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-15366: imaplib.IMAP4._command() concatenated each argument into the wire-level command without inspecting it, so user-controlled text (e.g. a username passed to IMAP4.login()) containing CR/LF or other control characters could inject a second IMAP command. A module-level _control_chars regex and a guard in _command() now reject any argument containing a byte in [\x00-\x1F\x7F] with ValueError before concatenation. - CVE-2025-15367: poplib.POP3._putcmd() sent its argument to the server without inspecting it, so user-controlled text passed to user()/pass_()/apop()/rpop()/top() could inject a second POP3 command. _putcmd() now rejects any argument containing a byte in [\x00-\x1F\x7F] with ValueError before sending. Important TuxCare License Agreement CVE-2025-15366 CVE-2025-15367 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-15366: imaplib.IMAP4._command() concatenated each command argument into the wire-level command without inspecting it, so a caller passing user-controlled text could inject extra IMAP commands using CR/LF or other control characters. Reject any byte in [\x00-\x1F\x7F] with ValueError before concatenation (upstream gh-143921 / 6262704b; mirrors RHSA-2026:6464 python3-3.6.8-21.el7_9.4). - CVE-2025-15367: poplib.POP3._putcmd() encoded its argument and sent it to the server without inspecting it, allowing the same command injection via user()/pass_()/apop()/rpop()/top(). Reject any byte in [\x00-\x1F\x7F] with ValueError before sending (upstream gh-143923 / b234a2b6; mirrors RHSA-2026:6464 python3-3.6.8-21.el7_9.4). Important TuxCare License Agreement CVE-2025-15366 CVE-2025-15367 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-9669: the bz2 BZ2Decompressor could be reused after a libbz2 decompression error; re-entering BZ2_bzDecompress() in that state can write past the end of a stack buffer (CWE-121). The decompressor now records the libbz2 error and refuses further decompress() calls with ValueError, becoming unusable after the first error (upstream gh-150599 / 5755d0f0, adapted to 3.6: plain needs_input reset and existing ACQUIRE_LOCK/RELEASE_LOCK wrappers, NEWS.d fragment omitted). Important TuxCare License Agreement CVE-2026-9669 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-11168: urlparse.urlsplit() did not validate the content of bracketed hosts, so domain names that are neither valid IPv6 nor IPvFuture literals were accepted inside "[" "]". A new _check_bracketed_host() is added (Lib/urlparse.py) and called from both the "http" fast-path and the generic branch of urlsplit(). Python 2.7 has no ipaddress module, so the bracket content is validated with socket.inet_pton() (IPv4 in brackets is rejected; otherwise the content must parse as IPv6). - CVE-2024-50602: a NULL pointer dereference in the bundled libexpat (Modules/expat/, 2.2.8) when XML_StopParser() was called on a parser in the XML_INITIALIZED state followed by XML_ResumeParser(). XML_StopParser() now refuses to stop/suspend an unstarted parser, returning the new XML_ERROR_NOT_STARTED. Backport of libexpat PR - CVE-2025-0938: completes CVE-2024-11168 by also rejecting square brackets in plain domain names. _check_bracketed_netloc() (Lib/urlparse.py) mirrors NetlocResultMixins._hostinfo() so data before/after the brackets is rejected; it replaces the inline bracket extraction in both branches of urlsplit(). Moderate TuxCare License Agreement CVE-2024-50602 CVE-2024-11168 CVE-2025-0938 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2013-0340: backport libexpat's billion-laughs / internal-entity-expansion amplification protection into the bundled expat 2.2.8 tree (Modules/expat/). xmlparse.c/expat.h/internal.h gain the libexpat 2.4.0 accounting machinery (XML_SetBillionLaughsAttackProtectionMaximumAmplification / ...ActivationThreshold, default 100x after 8 MiB) and a new XML_ERROR_AMPLIFICATION_LIMIT_BREACH; entity expansion that exceeds the amplification limit is now rejected instead of expanding unbounded. Adapted to coexist with the CloudLinux XML_SetHashSalt16Bytes extension; the system expat is NOT used. New public symbols are namespaced in pyexpatns.h. - CVE-2026-0865: reject C0/DEL control characters in wsgiref.headers.Headers (Lib/wsgiref/headers.py); HTAB stays legal in values but not names. Backport of gh-143916 (GH-143917) plus the HTAB follow-up (GH-144762). - CVE-2026-1502: reject CR/LF and other illegal characters in HTTP CONNECT tunnel host and request headers in HTTPConnection._tunnel() (Lib/httplib.py), using the existing _contains_disallowed_url_pchar_re / _is_legal_header_name / _is_illegal_header_value helpers. Backport of gh-146211 (GH-146212). - CVE-2026-6019: base64-encode the cookie value embedded in Cookie.Morsel.js_output() and emit it via atob() to prevent template injection (Lib/Cookie.py). Backport of gh-90309 (GH-148889), on top of CVE-2026-3644. - CVE-2026-9669: prevent bz2.BZ2Decompressor reuse after a decompression error (Modules/bz2module.c). After libbz2 reports an error the stream is inconsistent and re-entering it can overflow the output buffer; the decompressor now records the error and raises ValueError on any further decompress() call. Port of gh-150599 (GH-150600) to the 2.7 bz2 wrapper. Important TuxCare License Agreement CVE-2025-13462 CVE-2026-1502 CVE-2026-9669 CVE-2026-0865 CVE-2025-8291 CVE-2013-0340 CVE-2025-6069 CVE-2026-6019 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - ELS-2237: apply 06004 (skip test_simple_xml_chunk_1/_5) on el7 too, not just rhel >= 8. el7's expat now carries the 2.6 reparse-deferral backport while still reporting an older version, so those version-gated tests fail in %check as they already did on el8/el9. Critical TuxCare License Agreement CVE-2025-13836 CVE-2026-6100 CVE-2025-4516 CVE-2025-8194 CVE-2025-4435 CVE-2025-15282 CVE-2025-13462 CVE-2026-1502 CVE-2024-12718 CVE-2025-15366 CVE-2025-12084 CVE-2025-15367 CVE-2026-1299 CVE-2025-4138 CVE-2026-3644 CVE-2025-13837 CVE-2026-4519 CVE-2025-4330 CVE-2024-9287 CVE-2026-9669 CVE-2024-11168 CVE-2026-8328 CVE-2026-3446 CVE-2026-0865 CVE-2025-4517 CVE-2026-4224 CVE-2026-0672 CVE-2025-8291 CVE-2025-6069 CVE-2025-1795 CVE-2025-0938 CVE-2026-6019 CVE-2025-6075 CVE-2026-7210 CVE-2025-11468 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-9669: bz2.BZ2Decompressor records the libbz2 error code after a decompression failure and refuses any subsequent decompress() call with ValueError, instead of re-entering BZ2_bzDecompress() on an inconsistent bz_stream which could cause a stack buffer overflow (CWE-121). Critical TuxCare License Agreement CVE-2026-6100 CVE-2025-8194 CVE-2025-15282 CVE-2025-13462 CVE-2026-1502 CVE-2025-15366 CVE-2025-12084 CVE-2025-15367 CVE-2026-1299 CVE-2026-3644 CVE-2025-13837 CVE-2026-4519 CVE-2026-9669 CVE-2026-3446 CVE-2026-0865 CVE-2026-4224 CVE-2026-0672 CVE-2025-8291 CVE-2025-6069 CVE-2025-1795 CVE-2026-6019 CVE-2025-6075 CVE-2026-7210 CVE-2025-11468 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - ALTPYTH-591: Update to 3.11.15 version Moderate TuxCare License Agreement CVE-2024-6923 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - ALTPYTH-592: Update to 3.10.20 version Moderate TuxCare License Agreement CVE-2024-6923 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-40897: regex denial of service via crafted HTML in package_index - CVE-2024-6345: remote code execution via command injection in VCS download functions - CVE-2025-47273: path traversal in PackageIndex download filename resolution Important TuxCare License Agreement CVE-2025-47273 CVE-2022-40897 CVE-2024-6345 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-15366: reject control characters in imaplib IMAP4 commands - CVE-2025-15367: reject control characters in poplib POP3 commands - CVE-2026-3644: reject control characters in http.cookies Morsel.update(), |=, unpickling and js_output - CVE-2026-4224: add recursion guard to pyexpat conv_content_model() to prevent C stack overflow - CVE-2026-4519: reject webbrowser URLs with a leading dash to prevent argument injection Important TuxCare License Agreement CVE-2025-15366 CVE-2025-15367 CVE-2026-3644 CVE-2026-4519 CVE-2026-4224 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-15308: fix quadratic-complexity CPU denial-of-service in incremental HTML parsing (Lib/HTMLParser.py). feed() previously concatenated new data onto the unparsed buffer and re-scanned it from the start on every call, so feeding an unterminated construct in many small chunks was quadratic. New data is now accumulated in a list and only joined and parsed once enough has piled up, with close() flushing the pending buffer. Port of gh-153030 (GH-153031). Important TuxCare License Agreement CVE-2026-15308 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - el9: apply 06003 (BIO_eof ASN1 EOF, CPython gh-100372) so test_ssl test_load_verify_cadata / test_connect_cadata pass on OpenSSL >= 3.5 (el9 now ships openssl-libs 3.5.5, whose NOT_ENOUGH_DATA EOF reason code broke _add_ca_certs); the patch was previously gated to el10 only, which left the CL9 %check failing Important TuxCare License Agreement CVE-2026-15308 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - el9: apply 06005 (BIO_eof ASN1 EOF, CPython gh-100372) so test_ssl test_load_verify_cadata / test_connect_cadata pass on OpenSSL >= 3.5 (el9 now ships openssl-libs 3.5.5, whose NOT_ENOUGH_DATA EOF reason code broke _add_ca_certs); the patch was not wired into the RPM spec before, so the CL9 %check failed Important TuxCare License Agreement CVE-2026-15308 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-15308: html.parser.HTMLParser had quadratic complexity when an unterminated construct (tag, comment, declaration) was fed across many feed() calls, since each call rescanned the growing buffer and reconcatenated onto it, allowing a CPU denial-of-service on uncontrolled data. feed() now accumulates new data in a list and only joins and parses it once enough has piled up, flushing the buffer in close() (upstream gh-153030 / bcf98ddb, adapted to 3.6: identical feed()/close()/reset() logic, test added with "from test import support", NEWS.d fragment omitted). Important TuxCare License Agreement CVE-2026-15308 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-4786: reject action-token-expanded dash-prefixed args in webbrowser.open() (CVE-2026-4519 bypass) - CVE-2026-6100: fix dangling next_in pointer (UAF) in bz2/lzma decompressors after MemoryError on reuse - CVE-2026-7210: use XML_SetHashSalt16Bytes 16-byte entropy for Expat hash-flooding protection when available - CVE-2026-41080: backport libexpat XML_SetHashSalt16Bytes into the bundled expat (ubuntu16.04 / el7; other platforms link system expat) so the CVE-2026-7210 16-byte salt path is not inert - CVE-2026-9669: prevent bz2.BZ2Decompressor reuse after a decompression error (stack buffer overflow) Critical TuxCare License Agreement CVE-2026-6100 CVE-2025-15366 CVE-2025-15367 CVE-2026-3644 CVE-2026-4519 CVE-2026-9669 CVE-2026-4786 CVE-2026-4224 CVE-2026-7210 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-4786: fix action-substitution bypass of the CVE-2026-4519 webbrowser dash-prefix check - CVE-2026-6100: clear decompressor next_in on the error path in bz2/lzma to prevent use-after-free - CVE-2026-7210: use XML_SetHashSalt16Bytes for 16-byte Expat hash-flooding entropy - CVE-2026-41080: backport libexpat XML_SetHashSalt16Bytes into the bundled expat (Debian/Ubuntu, el7) so the CVE-2026-7210 16-byte salt path is not inert - CVE-2026-9669: refuse bz2 decompressor reuse after a previous error to prevent stack buffer overflow Critical TuxCare License Agreement CVE-2026-6100 CVE-2026-9669 CVE-2026-4786 CVE-2026-7210 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-15308: fix quadratic-complexity CPU DoS in html.parser.HTMLParser incremental parsing of long unterminated constructs Important TuxCare License Agreement CVE-2026-15308 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-15308: fix quadratic complexity in html.parser.HTMLParser incremental parsing of long unterminated markup declarations (CPU denial-of-service) Important TuxCare License Agreement CVE-2026-15308 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-40897: regex denial of service via crafted HTML in package_index - CVE-2024-6345: remote code execution via command injection in VCS download functions - CVE-2025-47273: path traversal in PackageIndex download filename resolution Important TuxCare License Agreement CVE-2025-47273 CVE-2022-40897 CVE-2024-6345 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-5752: Mercurial revision option injection in pip VCS URLs - CVE-2025-8869: symlink target not validated in tar extraction fallback - CVE-2026-1703: path traversal via os.path.commonprefix in is_within_directory - CVE-2026-3219: tar/ZIP polyglot archive type confusion in unpack_file - CVE-2026-6357: pip self-version check runs after install allowing module shadowing Low TuxCare License Agreement CVE-2026-1703 CVE-2025-8869 CVE-2023-5752 CVE-2026-3219 CVE-2026-6357 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-5752: Mercurial option injection via crafted VCS revision - CVE-2025-8869: arbitrary file overwrite via symlinks in sdist tarballs - CVE-2026-3219: archive confusion via tar/ZIP polyglot files - CVE-2026-1703: path traversal via string-prefix sibling directories - CVE-2026-6357: code execution via post-install pip self-version check imports Low TuxCare License Agreement CVE-2026-1703 CVE-2025-8869 CVE-2023-5752 CVE-2026-3219 CVE-2026-6357 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-5752: Mercurial configuration injection via VCS URL revision option - CVE-2025-8869: symlink targets not validated in fallback tar extraction - CVE-2026-1703: path traversal via prefix matching when extracting archives - CVE-2026-3219: concatenated tar/ZIP archives misinterpreted as ZIP - CVE-2026-6357: self-version check could import modules from newly installed wheels Low TuxCare License Agreement CVE-2026-1703 CVE-2025-8869 CVE-2023-5752 CVE-2026-3219 CVE-2026-6357 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-40898: regex denial of service via crafted wheel filename in WHEEL_INFO_RE Important TuxCare License Agreement CVE-2022-40898 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-40897: regex denial of service via crafted HTML in package_index - CVE-2024-6345: remote code execution via command injection in VCS download functions - CVE-2025-47273: path traversal in PackageIndex download filename resolution - Fix el7 build so the CVE fixes above can ship there: rpm 4.11 strips backslashes in shell-expansion macro bodies, so the sed capture group in the os_install_post override never matched and python3.9 modules were bytecompiled with the system python2, failing the install step on python3-only syntax; rewrite the sed without a group and stop relying on the interpreter-path macro from alt-python39-devel, whose macros file lives in /usr/lib/rpm/macros.d that rpm 4.11 does not read Important TuxCare License Agreement CVE-2025-47273 CVE-2022-40897 CVE-2024-6345 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-40898: denial of service via crafted input to wheel cli (ReDoS in WHEEL_INFO_RE) Important TuxCare License Agreement CVE-2022-40898 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-6345: remote code execution via command injection in VCS download functions - CVE-2025-47273: path traversal in PackageIndex download filename resolution Important TuxCare License Agreement CVE-2025-47273 CVE-2024-6345 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-40898: regex denial of service via crafted wheel filename in WHEEL_INFO_RE Important TuxCare License Agreement CVE-2022-40898 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-40898: redos in WHEEL_INFO_RE via wheel file names with many dashes; bound every lazy quantifier span with a character class. Important TuxCare License Agreement CVE-2022-40898 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-40898: denial of service via regular expression in WHEEL_INFO_RE Important TuxCare License Agreement CVE-2022-40898 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-40897: regex denial of service via crafted HTML in package_index - CVE-2024-6345: remote code execution via command injection in VCS download functions - CVE-2025-47273: path traversal in PackageIndex download filename resolution Important TuxCare License Agreement CVE-2025-47273 CVE-2022-40897 CVE-2024-6345 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-5752: Mercurial revision option injection via VCS URL - CVE-2025-8869: tar extraction misses symlink target check (no PEP 706 fallback) - CVE-2026-1703: path traversal via os.path.commonprefix containment check - CVE-2026-3219: tar/ZIP polyglot archive interpretation conflict - CVE-2026-6357: post-install self-version check could import malicious wheel content - Restore el7 byte-compile path (regression from 21.3.1-3): double the backslashes in the __os_install_post sed capture group so the rewrite to the alt-python interpreter survives rpm macro expansion on el7 Low TuxCare License Agreement CVE-2026-1703 CVE-2025-8869 CVE-2023-5752 CVE-2026-3219 CVE-2026-6357 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-0864: normalize CR/CRLF line endings in configparser writes to prevent key/value injection - CVE-2026-1502: reject CR/LF in http.client proxy CONNECT tunnel host and headers - CVE-2026-3276: fix O(n^2) canonical ordering in unicodedata.normalize() (DoS on crafted combining sequences) - CVE-2026-6019: percent-encode cookie values embedded in http.cookies js_output() to prevent script injection (XSS) - CVE-2026-7774: validate written link target in tarfile data filter to prevent path traversal - CVE-2026-8328: apply CVE-2021-4189 PASV peer-address check to ftplib.ftpcp() to prevent data-connection SSRF - CVE-2026-11940: fix symlink escape via tarfile hardlink-extraction fallback (path traversal) - CVE-2026-11972: make tarfile._Stream.seek() break at EOF to prevent infinite-loop DoS on crafted stream archives Important TuxCare License Agreement CVE-2026-1502 CVE-2026-0864 CVE-2026-11972 CVE-2026-3276 CVE-2026-8328 CVE-2026-11940 CVE-2026-6019 CVE-2026-7774 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-4360: TarFile.extract() did not forward the caller's filter to _extract_one(), so on the code path that extracts a hardlink the filter was silently dropped. An archive extracted with filter='data' could therefore create files with an attacker-chosen uid/gid instead of the filtered values (CWE-noinfo: incorrect enforcement of an extraction filter). Backport of cpython 7ccdbaba (gh-151987): extract() now passes filter_function through to _extract_one(). Important TuxCare License Agreement CVE-2026-4360 CVE-2026-0864 CVE-2026-11972 CVE-2026-3276 CVE-2026-8328 CVE-2026-11940 CVE-2026-7774 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2021-3572: Fix revision hijacking via unicode separators in git references Low TuxCare License Agreement CVE-2021-3572 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-12781: base64.b64decode() and urlsafe_b64decode() always accepted the standard-alphabet '+' and '/' characters even when an alternative alphabet excluding them was specified via altchars, so malformed input could bypass strict-alphabet validation filters (CWE-704: incorrect type conversion or cast, per NVD). Backport of cpython 9060b4ab (gh-125346, PR gh-141128): emits DeprecationWarning/FutureWarning when such characters are seen; decoded output is unchanged. Moderate TuxCare License Agreement CVE-2025-12781 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-3446: stop ignoring excess base64 data after the first padded quad in binascii.a2b_base64(), which backs base64.b64decode() - CVE-2026-11940: revalidate the hardlink's own shallower path in the tarfile extraction fallback so a symlink cannot escape the destination directory, and pass the extraction filter from extract() down to _extract_one() so the revalidation runs for single-member extraction as well and not only for extractall() - CVE-2026-6019: percent-encode the cookie value embedded in the http.cookies Morsel.js_output() script snippet and decode it with decodeURIComponent() to prevent breaking out of the script element while keeping UTF-8 values intact Important TuxCare License Agreement CVE-2025-12781 CVE-2025-13462 CVE-2026-1502 CVE-2026-0864 CVE-2026-11972 CVE-2026-3276 CVE-2026-8328 CVE-2026-3446 CVE-2026-11940 CVE-2025-1795 CVE-2026-6019 CVE-2026-7774 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-13462: skip tarfile AREGTYPE->DIRTYPE normalization while parsing GNU long name/link continuation headers (parser-differential) Low TuxCare License Agreement CVE-2025-13462 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-59890: MANIFEST.in exclusion bypass via Unicode normalization mismatch in FileList Moderate TuxCare License Agreement CVE-2026-59890 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-8328: ftplib: apply the CVE-2021-4189 PASV anti-SSRF fix to ftpcp() as well; ftpcp() previously passed the raw attacker-controllable IPv4 address and port from the source server's PASV reply straight to target.sendport(), letting a malicious source server redirect the target server's data connection to an arbitrary host:port. ftpcp() now uses the source server's real peer address, honoring the existing trust_server_pasv_ipv4_address opt-out Important TuxCare License Agreement CVE-2026-0864 CVE-2026-11972 CVE-2026-3276 CVE-2026-8328 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-11940: tarfile: fix extraction-filter bypass via the hardlink-to-symlink extraction fallback; makelink_with_filter now re-runs the filter on the member re-rooted at the link's own path, so a crafted archive can no longer recreate a validated deeper symlink at a shallower path escaping the destination (incomplete fix of CVE-2025-4330) - CVE-2026-0864: configparser: normalize all line endings (CR, CRLF, LF) to '\n\t' when writing, preventing injection of unexpected keys, values, or sections through carriage returns in written values - CVE-2026-11972: tarfile: break _Stream.seek() at EOF in streaming mode (mode="r|"), preventing a CPU denial-of-service when a forged member header declares a huge size against an already-exhausted stream - CVE-2026-4360: tarfile: forward filter_function from TarFile.extract() to _extract_one(), so the hardlink/symlink extraction fallback applies the extraction filter on the single-member extract() path too; previously attacker-controlled mode, uid and gid were applied verbatim even with filter='data' and the CVE-2025-4330/CVE-2026-11940 fallback checks never ran there (cpython 7ccdbaba, gh-151987, follow-up to gh-151558) Important TuxCare License Agreement CVE-2026-4360 CVE-2026-0864 CVE-2026-11972 CVE-2026-11940 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-7774: tarfile: fix data_filter bypass via crafted link entries; validate the normalised link target that is actually written to disk, resolve symlink targets relative to the member name with trailing separators stripped, and reject link members (including symlinks with empty or directory-like names) that would replace the destination directory itself and redirect later members outside it - CVE-2026-8328: ftplib: apply the CVE-2021-4189 PASV anti-SSRF fix to ftpcp(): use the source server's real peer address instead of the attacker-controllable IPv4 address from the PASV reply unless trust_server_pasv_ipv4_address is set Important TuxCare License Agreement CVE-2026-4360 CVE-2026-0864 CVE-2026-11972 CVE-2026-3276 CVE-2026-8328 CVE-2026-11940 CVE-2026-7774 cpe:/o:centos:centos:9 alt-python36 alt-python36-debug alt-python36-devel alt-python36-libs alt-python36-test alt-python36-tkinter alt-python36-tools alt-python27 alt-python27-debug alt-python27-devel alt-python27-libs alt-python27-test alt-python27-tkinter alt-python27-tools alt-python38 alt-python38-devel alt-python38-idle alt-python38-libs alt-python38-test alt-python38-tkinter alt-python39 alt-python39-debug alt-python39-devel alt-python39-idle alt-python39-libs alt-python39-test alt-python39-tkinter alt-python311 alt-python311-debug alt-python311-devel alt-python311-idle alt-python311-libs alt-python311-test alt-python311-tkinter alt-python310 alt-python310-debug alt-python310-devel alt-python310-idle alt-python310-libs alt-python310-test alt-python310-tkinter alt-python38-setuptools alt-python38-setuptools-wheel alt-python36-setuptools alt-python310-pip alt-python310-pip-wheel alt-python311-pip alt-python311-pip-wheel alt-python38-pip alt-python38-pip-wheel alt-python38-wheel alt-python38-wheel-wheel alt-python39-setuptools alt-python39-setuptools-wheel alt-python311-wheel alt-python311-wheel-wheel alt-python311-setuptools alt-python311-setuptools-wheel alt-python39-wheel alt-python39-wheel-wheel alt-python36-wheel alt-python36-wheel-wheel alt-python310-wheel alt-python310-wheel-wheel alt-python310-setuptools alt-python310-setuptools-wheel alt-python39-pip alt-python39-pip-wheel alt-python36-pip alt-python36-pip-wheel x86_64 0:3.6.15-6.el9 d07bf2a08d50eb66 x86_64 0:3.6.15-7.el9 x86_64 0:3.6.15-8.el9 x86_64 0:2.7.18-14.el9 x86_64 0:2.7.18-16.el9 x86_64 0:2.7.18-20.el9 x86_64 0:2.7.18-21.el9 x86_64 0:3.6.15-13.el9 x86_64 0:3.6.15-16.el9 x86_64 0:2.7.18-22.el9 x86_64 0:3.6.15-17.el9 x86_64 0:2.7.18-23.el9 x86_64 0:3.6.15-18.el9 x86_64 0:3.6.15-19.el9 x86_64 0:2.7.18-24.el9 x86_64 0:2.7.18-25.el9 x86_64 0:3.6.15-20.el9 x86_64 0:2.7.18-27.el9 x86_64 0:3.6.15-21.el9 x86_64 0:2.7.18-29.el9 x86_64 0:2.7.18-30.el9 x86_64 0:3.6.15-22.el9 x86_64 0:3.6.15-23.el9 x86_64 0:2.7.18-31.el9 x86_64 0:3.6.15-24.el9 x86_64 0:2.7.18-32.el9 x86_64 0:3.6.15-25.el9 x86_64 0:2.7.18-33.el9 x86_64 0:3.6.15-28.el9 x86_64 0:2.7.18-34.el9 x86_64 0:3.6.15-29.el9 x86_64 0:3.6.15-30.el9 x86_64 0:2.7.18-35.el9 x86_64 0:2.7.18-37.el9 x86_64 0:3.8.20-19.el9 x86_64 0:3.9.23-17.el9 x86_64 0:3.11.15-1.el9 x86_64 0:3.10.20-1.el9 0:58.3.0-3.el9 x86_64 0:3.10.20-2.el9 x86_64 0:2.7.18-38.el9 x86_64 0:3.9.23-20.el9 x86_64 0:3.8.20-21.el9 x86_64 0:3.6.15-31.el9 x86_64 0:3.11.15-3.el9 x86_64 0:3.10.20-3.el9 x86_64 0:3.10.20-4.el9 x86_64 0:3.11.15-4.el9 0:38.5.2-9.el9 0:21.3.1-6.el9 0:21.3.1-5.el9 0:22.2.1-5.el9 1:0.37.1-3.el9 0:58.3.0-5.el9 0:0.37.0-2.el9 0:65.6.3-4.el9 0:0.37.0-4.el9 0:0.31.1-2.el9 0:0.37.0-5.el9 0:21.3.1-4.el9 x86_64 0:3.11.15-5.el9 x86_64 0:3.9.23-24.el9 0:20.2.4-6.el9 x86_64 0:3.9.23-21.el9 x86_64 0:3.10.20-9.el9 x86_64 0:3.11.15-6.el9 0:38.5.2-10.el9 x86_64 0:2.7.18-41.el9 x86_64 0:3.8.20-22.el9 x86_64 0:3.6.15-34.el9