RHSA-2026:7661HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
April 11, 2026
Last Modified
September 10, 2026

🔗 CVE IDs covered (16)

CVE-2026-4224 →CVE-2026-4519 →CVE-2025-12084 →CVE-2025-13462 →CVE-2025-13836 →CVE-2025-15282 →CVE-2026-1299 →CVE-2026-2297 →CVE-2026-3479 →CVE-2025-8291 →CVE-2025-11468 →CVE-2025-13837 →CVE-2026-0865 →CVE-2026-3446 →CVE-2026-3644 →CVE-2025-6075 →

📋 Description

CVE-2025-6075 — python: Quadratic complexity in os.path.expandvars() with user-controlled template CVE-2025-8291 — cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked CVE-2025-11468 — cpython: Missing character filtering in Python CVE-2025-12084 — cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service CVE-2025-13462 — cpython: cpython: tarfile module misinterprets crafted tar archives leading to data integrity issues CVE-2025-13836 — cpython: Excessive read buffering DoS in http.client CVE-2025-13837 — cpython: Out-of-memory when loading Plist CVE-2025-15282 — cpython: Header injection via newlines in data URL mediatype in Python CVE-2026-0865 — cpython: wsgiref.headers.Headers allows header newline injection in Python CVE-2026-1299 — cpython: email header injection due to unquoted newlines CVE-2026-2297 — cpython: CPython: Logging Bypass in Legacy .pyc File Handling CVE-2026-3446 — python: Python base64: Incomplete data decoding due to premature stop at padding CVE-2026-3479 — python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation CVE-2026-3644 — cpython: Incomplete control character validation in http.cookies CVE-2026-4224 — cpython: Stack overflow parsing XML with deeply nested DTD content models CVE-2026-4519 — python: Python: Command-line option injection in webbrowser.open() via crafted URLs

🎯 Affected products5

  • Red Hat Hardened Images
  • python3-14-main@aarch64 as a component of Red Hat Hardened Images
  • python3-14-main@noarch as a component of Red Hat Hardened Images
  • python3-14-main@src as a component of Red Hat Hardened Images
  • python3-14-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Avoid using Python's tarfile module to extract untrusted archives. If processing untrusted archives is required, delegate extraction to the system-level tar utility (via the subprocess module). For Python 3.12 or newer, you can instead enforce strict extraction filters using tarfile.data_filter to secure the module's extraction behavior. Workaround: Since this vulnerability is triggered when no read amount is specified and the client defaults to using the potentially malicious Content-Length header, developers can mitigate this issue in their code by always imposing an explicit, safe limit on data reads. Applications using the http.client.HTTPResponse.read function directly can ensure that read operations specify a byte limit: ~~~ ... max_safe_read = 10 * 1024 * 1024 data = response.read(max_safe_read) ... ~~~ Workaround: To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, '\r' or '\n', respectively, preventing malicious sequences that could lead to header manipulation.

🔗 References (20)