RHSA-2026:8824HighCVSS 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
April 17, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (18)

CVE-2026-5713 →CVE-2025-8291 →CVE-2026-3644 →CVE-2026-4786 →CVE-2026-1299 →CVE-2025-13836 →CVE-2025-15366 →CVE-2026-0865 →CVE-2026-4224 →CVE-2025-6075 →CVE-2026-1502 →CVE-2026-6100 →CVE-2026-2297 →CVE-2025-11468 →CVE-2025-12084 →CVE-2025-13837 →CVE-2025-15282 →CVE-2025-15367 →

📋 Description

CVE-2025-6075 — python: Quadratic complexity in os.path.expandvars() with user-controlled template CVE-2025-8291 — cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked CVE-2025-11468 — cpython: Missing character filtering in Python CVE-2025-12084 — cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service CVE-2025-13836 — cpython: Excessive read buffering DoS in http.client CVE-2025-13837 — cpython: Out-of-memory when loading Plist CVE-2025-15282 — cpython: Header injection via newlines in data URL mediatype in Python CVE-2025-15366 — cpython: IMAP command injection in user-controlled commands CVE-2025-15367 — cpython: POP3 command injection in user-controlled commands CVE-2026-0865 — cpython: wsgiref.headers.Headers allows header newline injection in Python CVE-2026-1299 — cpython: email header injection due to unquoted newlines CVE-2026-1502 — python: Python: HTTP header injection via CR/LF in proxy tunnel headers CVE-2026-2297 — cpython: CPython: Logging Bypass in Legacy .pyc File Handling CVE-2026-3644 — cpython: Incomplete control character validation in http.cookies CVE-2026-4224 — cpython: Stack overflow parsing XML with deeply nested DTD content models CVE-2026-4786 — python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API CVE-2026-5713 — python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. CVE-2026-6100 — python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules

🎯 Affected products4

  • Red Hat Hardened Images
  • python3-12-main@aarch64 as a component of Red Hat Hardened Images
  • python3-12-main@src as a component of Red Hat Hardened Images
  • python3-12-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Since this vulnerability is triggered when no read amount is specified and the client defaults to using the potentially malicious Content-Length header, developers can mitigate this issue in their code by always imposing an explicit, safe limit on data reads. Applications using the http.client.HTTPResponse.read function directly can ensure that read operations specify a byte limit: ~~~ ... max_safe_read = 10 * 1024 * 1024 data = response.read(max_safe_read) ... ~~~ Workaround: To mitigate this vulnerability, ensure that no data passed to the imaplib module contains newline or carriage return characters. Workaround: To mitigate this vulnerability, ensure that no data passed to the poplib module contains newline or carriage return characters. Workaround: To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, '\r' or '\n', respectively, preventing malicious sequences that could lead to header manipulation.

🔗 References (22)