RHSA-2026:68309HighCVSS 7.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
September 16, 2026
Last Modified
October 2, 2026

🔗 CVE IDs covered (6)

CVE-2026-9669 →CVE-2026-12003 →CVE-2026-82049 →CVE-2026-3276 →CVE-2026-7210 →CVE-2026-8328 →

📋 Description

CVE-2026-3276 — python: Python unicodedata: Denial of Service due to excessive CPU consumption CVE-2026-7210 — python: Python/Expat: Denial of Service via crafted XML document CVE-2026-8328 — python: Python: FTP connection redirection via ftpcp() function bypass CVE-2026-9669 — python: Python: Denial of Service via out-of-bounds write in BZ2 decompression CVE-2026-12003 — python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers CVE-2026-82049 — python: Python tarfile module: File modification and content disclosure via crafted archives

🎯 Affected products20

  • Red Hat Hardened Images
  • python3.13-0:3.13.15-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.13-0:3.13.15-1.3.hum1@src as a component of Red Hat Hardened Images
  • python3.13-0:3.13.15-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.13-debug-0:3.13.15-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.13-debug-0:3.13.15-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.13-devel-0:3.13.15-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.13-devel-0:3.13.15-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.13-freethreading-0:3.13.15-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.13-freethreading-0:3.13.15-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.13-freethreading-debug-0:3.13.15-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.13-freethreading-debug-0:3.13.15-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.13-idle-0:3.13.15-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.13-idle-0:3.13.15-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.13-libs-0:3.13.15-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.13-libs-0:3.13.15-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.13-test-0:3.13.15-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.13-test-0:3.13.15-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.13-tkinter-0:3.13.15-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.13-tkinter-0:3.13.15-1.3.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Applications processing untrusted BZ2 compressed data should avoid reusing `bz2.BZ2Decompressor` objects after a decompression error. Instead, a new `bz2.BZ2Decompressor` instance should be created for each new decompression attempt or after an error occurs. This prevents the decompressor from resuming from an invalid internal state.

🔗 References (10)