CVE-2025-13462

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.(CVE-2025-13462)

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.

pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.(CVE-2026-3479)

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().(CVE-2026-3644)

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.(CVE-2026-4224)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.(CVE-2025-13462)

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.

pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.(CVE-2026-3479)

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().(CVE-2026-3644)

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.(CVE-2026-4224)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.(CVE-2025-13462)

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.

pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.(CVE-2026-3479)

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().(CVE-2026-3644)

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.(CVE-2026-4224)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.(CVE-2025-13462)

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.

pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.(CVE-2026-3479)

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().(CVE-2026-3644)

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.(CVE-2026-4224)

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

• SECURITY UPDATE: tarfile module misinterprets AREGTYPE blocks as DIRTYPE when processing GNU long name or link headers
  • debian/patches/CVE-2025-13462.patch: add dircheck parameter to frombuf() and fromtarfile() and pass dircheck=False from _proc_gnulong() and _proc_pax() to prevent AREGTYPE-to-DIRTYPE normalisation on follow-up headers in Lib/tarfile.py, Lib/test/test_tarfile.py
  • CVE-2025-13462

• CVE-2025-13462: tarfile: skip AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers, so a longname regular file is not misparsed as a directory

• CVE-2025-13462: tarfile: skip AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers, so a longname regular file is not misparsed as a directory

• CVE-2025-13462: tarfile: skip AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers, so a longname regular file is not misparsed as a directory

• CVE-2025-13462: tarfile: skip AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers, so a longname regular file is not misparsed as a directory

• CVE-2025-13462: do not apply the v7 AREGTYPE->DIRTYPE normalization when re-parsing GNU LONGNAME/LONGLINK follow-up headers in tarfile, preventing crafted archives from flipping an entry's type

• CVE-2025-13462: do not apply the v7 AREGTYPE->DIRTYPE normalization when re-parsing GNU LONGNAME/LONGLINK follow-up headers in tarfile, preventing crafted archives from flipping an entry's type

• CVE-2025-13462: tarfile: skip AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers, so a longname regular file is not misparsed as a directory

• SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply nested DTD content models
  • debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to bound recursion when a registered ElementDeclHandler converts a deeply nested content model.
  • CVE-2026-4224
• SECURITY UPDATE: HTTP header injection via control characters in cookies
  • debian/patches/CVE-2026-0672.patch: add _has_control_character() and reject control characters in Morsel.setitem()/setdefault()/set() and BaseCookie.output() in Lib/http/cookies.py.
  • CVE-2026-0672
• SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in cookies via additional Morsel paths)
  • debian/patches/CVE-2026-3644.patch: reject control characters in Morsel.update(), Morsel.setstate() and Morsel.js_output() in Lib/http/cookies.py.
  • CVE-2026-3644
• SECURITY UPDATE: tarfile member type confusion (regular file parsed as directory) via GNU long name/link headers
  • debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers (dircheck=False) in Lib/tarfile.py.
  • CVE-2025-13462

• SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply nested DTD content models
  • debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to bound recursion when a registered ElementDeclHandler converts a deeply nested content model.
  • CVE-2026-4224
• SECURITY UPDATE: HTTP header injection via control characters in cookies
  • debian/patches/CVE-2026-0672.patch: add _has_control_character() and reject control characters in Morsel.setitem()/setdefault()/set() and BaseCookie.output() in Lib/http/cookies.py.
  • CVE-2026-0672
• SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in cookies via additional Morsel paths)
  • debian/patches/CVE-2026-3644.patch: reject control characters in Morsel.update(), Morsel.setstate() and Morsel.js_output() in Lib/http/cookies.py.
  • CVE-2026-3644
• SECURITY UPDATE: tarfile member type confusion (regular file parsed as directory) via GNU long name/link headers
  • debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers (dircheck=False) in Lib/tarfile.py.
  • CVE-2025-13462

• SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply nested DTD content models
  • debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to bound recursion when a registered ElementDeclHandler converts a deeply nested content model.
  • CVE-2026-4224
• SECURITY UPDATE: HTTP header injection via control characters in cookies
  • debian/patches/CVE-2026-0672.patch: reject control characters in Morsel.setitem()/set(), add a validating Morsel.setdefault() override, and guard BaseCookie.output() in Lib/Cookie.py.
  • CVE-2026-0672
• SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in cookies via additional Morsel paths)
  • debian/patches/CVE-2026-3644.patch: add a validating Morsel.update() override and reject control characters in Morsel.js_output() in Lib/Cookie.py.
  • CVE-2026-3644
• SECURITY UPDATE: tarfile member type confusion (regular file parsed as directory) via GNU long name/link headers
  • debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers (dircheck=False) in Lib/tarfile.py.
  • CVE-2025-13462

• SECURITY UPDATE: tarfile misinterprets crafted multi-block GNU long name archives via AREGTYPE/DIRTYPE normalization
  • debian/patches/CVE-2025-13462.patch: skip the old-v7 AREGTYPE to DIRTYPE normalization when reading the follow-up header of a GNU LONGNAME / LONGLINK or PAX member in Lib/tarfile.py
  • CVE-2025-13462
• SECURITY UPDATE: C stack overflow in pyexpat when an ElementDeclHandler parses a deeply nested content model
  • debian/patches/CVE-2026-4224.patch: guard conv_content_model() recursion with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() in Modules/pyexpat.c
  • CVE-2026-4224
• SECURITY UPDATE: insufficient entropy in pyexpat/_elementtree hash-flooding protection
  • debian/patches/CVE-2026-7210.patch: bind XML_SetHashSalt16Bytes as a weak symbol to seed the Expat parser with 16 bytes of entropy when hash randomization is enabled; falls back to the legacy XML_SetHashSalt when unavailable. Requires libexpat1 (>= 2.2.6-2+deb10u7+tuxcare.els6).
  • CVE-2026-7210

• SECURITY UPDATE: tarfile AREGTYPE->DIRTYPE misnormalization of multi-block member headers
  • debian/patches/CVE-2025-13462.patch: in Lib/tarfile.py, add a dircheck flag to frombuf()/fromtarfile() and read the follow-up header of GNU long-name and PAX multi-block members with dircheck=False in _proc_gnulong()/_proc_pax(), so the old-V7 "AREGTYPE name ending in / is a directory" normalization is no longer applied to a follow-up header based on its truncated name. Prevents a crafted tar archive from being interpreted differently by tarfile than by other tools. Backport of upstream commit 42d754e34c (gh-141707), the same fix shipped by Debian in DLA-4583-1; applies to 3.7.3 without code changes (the affected functions are structurally identical). Bundles the upstream regression test test_longname_file_not_directory (test_tarfile.py).
  • CVE-2025-13462
• SECURITY UPDATE: C stack overflow in pyexpat via deeply nested DTD content model
  • debian/patches/CVE-2026-4224.patch: guard the recursion in Modules/pyexpat.c conv_content_model() with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() so a deeply nested inline DTD content model parsed by an Expat parser with a registered ElementDeclHandler raises RecursionError instead of crashing the interpreter. Adapted from upstream commit eb0e8be3a7 (gh-145986); upstream uses the private _Py_EnterRecursiveCall() API, replaced here with the equivalent public 3.7 macros. The upstream regression test is not bundled (it needs 3.7-absent test.support helpers and a 500000-deep model); the fix was verified manually.
  • CVE-2026-4224
• SECURITY UPDATE: control-character injection in http.cookies (HTTP response splitting)
  • debian/patches/CVE-2026-3644.patch: reject control characters (\x00-\x1F, \x7F) in Lib/http/cookies.py across all Morsel/BaseCookie paths via a new _has_control_character() helper. CVE-2026-3644 is the incomplete-fix follow-up to CVE-2026-0672 and its upstream fix (commit 57e88c1cf9, gh-145599) depends on the helper introduced by the CVE-2026-0672 base commit (95746b3a13, gh-143919). 3.7.3 shipped neither fix, so this patch bundles both: the base validation in Morsel.setitem/setdefault/set and BaseCookie.output, plus the follow-up validation in Morsel.update/setstate and BaseCookie.js_output. Also closes CVE-2026-0672. The upstream Morsel.ior override is omitted: it only exists to neutralize dict.ior (PEP 584, Python 3.9+), which 3.7 does not have, so there is no |= bypass to close. The module docstring doctest and the test_basic keebler fixture in test_http_cookies.py are updated to drop a \012 control character now rejected by load(), and the upstream regression tests test_control_characters/test_control_characters_output are bundled with the test.support.control_characters_c0() helper they require.
  • CVE-2026-3644

• SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply nested DTD content models
  • debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to bound recursion when a registered ElementDeclHandler converts a deeply nested content model.
  • CVE-2026-4224
• SECURITY UPDATE: HTTP header injection via control characters in cookies
  • debian/patches/CVE-2026-0672.patch: reject control characters in Morsel.setitem()/set(), add a validating Morsel.setdefault() override, and guard BaseCookie.output() in Lib/Cookie.py.
  • CVE-2026-0672
• SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in cookies via additional Morsel paths)
  • debian/patches/CVE-2026-3644.patch: add a validating Morsel.update() override and reject control characters in Morsel.js_output() in Lib/Cookie.py.
  • CVE-2026-3644
• SECURITY UPDATE: tarfile member type confusion (regular file parsed as directory) via GNU long name/link headers
  • debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers (dircheck=False) in Lib/tarfile.py.
  • CVE-2025-13462

• CVE-2026-0672: reject control characters in http.cookies.Morsel fields and values
• CVE-2026-3644: complete CVE-2026-0672 fix: reject control chars in Morsel.update(), |=, unpickling and js_output()
• CVE-2026-4224: avoid unbound C recursion in pyexpat conv_content_model to prevent C stack overflow
• CVE-2025-13462: skip TarInfo AREGTYPE->DIRTYPE normalization on GNU longname/longlink follow-up headers in tarfile

• CVE-2026-0672: reject control characters in http.cookies.Morsel fields and values
• CVE-2026-3644: complete CVE-2026-0672 fix: reject control chars in Morsel.update(), |=, unpickling and js_output()
• CVE-2026-4224: avoid unbound C recursion in pyexpat conv_content_model to prevent C stack overflow
• CVE-2025-13462: skip TarInfo AREGTYPE->DIRTYPE normalization on GNU longname/longlink follow-up headers in tarfile

• CVE-2026-0672: reject control characters in http.cookies.Morsel fields and values
• CVE-2026-3644: complete CVE-2026-0672 fix: reject control chars in Morsel.update(), |=, unpickling and js_output()
• CVE-2026-4224: avoid unbound C recursion in pyexpat conv_content_model to prevent C stack overflow
• CVE-2025-13462: skip TarInfo AREGTYPE->DIRTYPE normalization on GNU longname/longlink follow-up headers in tarfile

• CVE-2026-0672: reject control characters in the Cookie module - add the _has_control_character() helper and validate in Morsel.setitem, Morsel.setdefault(), Morsel.set() and BaseCookie.output(). Applied as the prerequisite for CVE-2026-3644; Python 2.7.5 shipped neither fix.
• CVE-2026-3644: reject control characters in Morsel.update(), the unpickling path (Morsel.setstate) and Morsel.js_output().
• CVE-2026-4224: guard conv_content_model() in pyexpat with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() to avoid a C stack overflow when parsing a deeply nested content model in an inline DTD with a registered ElementDeclHandler.
• CVE-2025-13462: skip the old-v7 AREGTYPE -> DIRTYPE normalization in tarfile when reading a follow-up header (GNU long name/link or PAX extended header), so crafted multi-block members are no longer misinterpreted.

• CVE-2026-0672: reject control characters in the Cookie module - add the _has_control_character() helper and validate in Morsel.setitem, Morsel.setdefault(), Morsel.set() and BaseCookie.output(). Applied as the prerequisite for CVE-2026-3644; Python 2.7.5 shipped neither fix.
• CVE-2026-3644: reject control characters in Morsel.update(), the unpickling path (Morsel.setstate) and Morsel.js_output().
• CVE-2026-4224: guard conv_content_model() in pyexpat with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() to avoid a C stack overflow when parsing a deeply nested content model in an inline DTD with a registered ElementDeclHandler.
• CVE-2025-13462: skip the old-v7 AREGTYPE -> DIRTYPE normalization in tarfile when reading a follow-up header (GNU long name/link or PAX extended header), so crafted multi-block members are no longer misinterpreted.

These are all security issues fixed in the python315-3.15.0~a7-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.20-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.15-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.13-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.12-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.3-4.1 package on the GA media of openSUSE Tumbleweed.

This update for python313 fixes the following issues:

Update to version 3.13.13.

• CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to misinterpretation of tar archives (bsc#1259611).
• CVE-2026-2297: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).
• CVE-2026-3479: improper resource argument validation in pkgutil.get_data() can lead to path traversal (bsc#1259989).
• CVE-2026-3644: incomplete control character validation in http.cookies can lead to input validation bypass (bsc#1259734).
• CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to C stack overflow (bsc#1259735).
• CVE-2026-4519: failure to sanitize leading dashes in URLs in the webbrowser.open() API can lead to web browser command line option injection (bsc#1260026).

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Root has patched CVE-2025-13462 in the rootio-python3.11 package for Root:Debian:12. Multiple fixed versions available.

This update for python fixes the following issues:

• CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to misinterpretation of tar archives (bsc#1259611).
• CVE-2026-3644: incomplete control character validation in http.cookies can lead to input validation bypass (bsc#1259734).
• CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to C stack overflow (bsc#1259735).
• CVE-2026-4519: failure to sanitize leading dashes in URLs in the webbrowser.open() API can lead to web browser command line option injection (bsc#1260026).

This update for python312 fixes the following issues:

• CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to misinterpretation of tar archives (bsc#1259611).
• CVE-2026-3479: improper resource argument validation in pkgutil.get_data() can lead to path traversal (bsc#1259989).
• CVE-2026-3644: incomplete control character validation in http.cookies can lead to input validation bypass (bsc#1259734).
• CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to C stack overflow (bsc#1259735).
• CVE-2026-4519: failure to sanitize leading dashes in URLs in the webbrowser.open() API can lead to web browser command line option injection (bsc#1260026).

This update for python39 fixes the following issues:

• CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to misinterpretation of tar archives (bsc#1259611).
• CVE-2026-3644: incomplete control character validation in http.cookies can lead to input validation bypass (bsc#1259734).
• CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to C stack overflow (bsc#1259735).
• CVE-2026-4519: failure to sanitize leading dashes in URLs in the webbrowser.open() API can lead to web browser command line option injection (bsc#1260026).

This update for python36 fixes the following issues:

• CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
• CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
• CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
• CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
• CVE-2026-4519: leading dashes in URLs are accepted by the webbrowser.open() API and allow for web browser command line option injection (bsc#1260026).

This update for python311 fixes the following issues:

• Updated to Python 3.11.15
• CVE-2025-6075: If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables (bsc#1252974).
• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2025-12084: cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (bsc#1254997).
• CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
• CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length (bsc#1254400).
• CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues (bsc#1254401).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
• CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in BytesGenerator (bsc#1257181).
• CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).
• CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
• CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
• CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
• CVE-2026-4519: leading dashes in URLs are accepted by the webbrowser.open() API and allow for web browser command line option injection (bsc#1260026).