CVE-2026-49853

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

Summary

When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin.

As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default.

Beginning in Tornado 6.5.6, SimpleAsyncHTTPClient matches the default behavior of libcurl (and therefore CurlAsyncHTTPClient): When a redirect changes the scheme, host, or port of the url, the Authorization and Cookie headers will be removed when following the redirect.

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin. As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default. Beginning in Tornado 6.5.6, SimpleAsyncHTTPClient matches the default behavior of libcurl (and therefore CurlAsyncHTTPClient): When a redirect changes the scheme, host, or port of the url, the Authorization and Cookie headers will be removed when following the redirect.(CVE-2026-49853)

SummaryTornado's optional native extension tornado.speedups implements websocket_mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.The behavior is reachable from Tornado's XSRF token decoder when xsrf_cookies=True and the native extension is active. ### MitigationsThis bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).(CVE-2026-49854)

Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total compressed size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. HTTPServer is not affected in its default configuration, but it is if decompress_request=True is set. This bug is fixed in Tornado 6.5.6. max_body_size is now checked both for the compressed and cumulative decompressed size of the response.(CVE-2026-49855)

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin. As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default. Beginning in Tornado 6.5.6, SimpleAsyncHTTPClient matches the default behavior of libcurl (and therefore CurlAsyncHTTPClient): When a redirect changes the scheme, host, or port of the url, the Authorization and Cookie headers will be removed when following the redirect.(CVE-2026-49853)

SummaryTornado's optional native extension tornado.speedups implements websocket_mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.The behavior is reachable from Tornado's XSRF token decoder when xsrf_cookies=True and the native extension is active. ### MitigationsThis bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).(CVE-2026-49854)

Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total compressed size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. HTTPServer is not affected in its default configuration, but it is if decompress_request=True is set. This bug is fixed in Tornado 6.5.6. max_body_size is now checked both for the compressed and cumulative decompressed size of the response.(CVE-2026-49855)

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.

Security Fix(es):

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.(CVE-2023-54397)

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.(CVE-2024-14029)

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.(CVE-2024-58384)

When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin. As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default. Beginning in Tornado 6.5.6, SimpleAsyncHTTPClient matches the default behavior of libcurl (and therefore CurlAsyncHTTPClient): When a redirect changes the scheme, host, or port of the url, the Authorization and Cookie headers will be removed when following the redirect.(CVE-2026-49853)

SummaryTornado's optional native extension tornado.speedups implements websocket_mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.The behavior is reachable from Tornado's XSRF token decoder when xsrf_cookies=True and the native extension is active. ### MitigationsThis bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).(CVE-2026-49854)

Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total compressed size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. HTTPServer is not affected in its default configuration, but it is if decompress_request=True is set. This bug is fixed in Tornado 6.5.6. max_body_size is now checked both for the compressed and cumulative decompressed size of the response.(CVE-2026-49855)

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and…

Summary

When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin.

As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default.

Beginning in Tornado 6.5.6, SimpleAsyncHTTPClient matches the default behavior of libcurl (and therefore CurlAsyncHTTPClient): When a redirect changes the scheme, host, or port of the url, the Authorization and Cookie headers will be removed when following the redirect.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects (CVE-2026-49853)

• tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects (CVE-2026-49853)

• tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects (CVE-2026-49853)
• tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects (CVE-2026-49853)
• tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

TuxCare rebuilt tornado to address 3 CVEs. Fixed in 6.1.0.post4+tuxcare.

TuxCare rebuilt tornado to address 15 CVEs. Fixed in 5.1.1.post4+tuxcare.

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Tornado has out-of-bounds memory access via C extension tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

These are all security issues fixed in the python311-tornado6-6.5.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-tornado6 fixes the following issues

• CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
• CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
• CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

Root has patched CVE-2026-49853 in the tornado package for Root:PyPI. Multiple fixed versions available.

This update for python-tornado6 fixes the following issues

• CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
• CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
• CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

This update for python-tornado6 fixes the following issues

• CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
• CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
• CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

This update for python-tornado6 fixes the following issues

• CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
• CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
• CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

This update for python-tornado6 fixes the following issues

• CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
• CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
• CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

This update for python-tornado6 fixes the following issues

• CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
• CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
• CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

This update for python-tornado fixes the following issues

• CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
• CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
• CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

This update for python-tornado fixes the following issues

• CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
• CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
• CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

This update fixes the following issues:

scap-security-guide was updated to version 0.1.79:

• Version 0.1.79 (jsc#ECO-3319)
  • Added SLE16 profiles to the build
  • Create SLE16 HIPAA profile
  • Create SLE16 PCI DSS 4 profile
  • Use Sequoia in RHEL 10 instead of GPG
  • New Profile for RHEL10: BSI
  • Move RHEL Control files to product files
  • Update RHEL 9 CCN profile
  • Various updates for SLE 12/15

spacecmd was updated to version 5.2.10:

• Version 5.2.10:
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9:
  • Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks…

This update fixes the following issues:

scap-security-guide was updated to version 0.1.79:

• Version 0.1.79 (jsc#ECO-3319)
  • Added SLE16 profiles to the build
  • Create SLE16 HIPAA profile
  • Create SLE16 PCI DSS 4 profile
  • Use Sequoia in RHEL 10 instead of GPG
  • New Profile for RHEL10: BSI
  • Move RHEL Control files to product files
  • Update RHEL 9 CCN profile
  • Various updates for SLE 12/15

spacecmd was updated to version 5.2.10:

• Version 5.2.10:
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9:
  • Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks…

This update fixes the following issues:

scap-security-guide was updated to version 0.1.79:

• Version 0.1.79 (jsc#ECO-3319)
  • Added SLE16 profiles to the build
  • Create SLE16 HIPAA profile
  • Create SLE16 PCI DSS 4 profile
  • Use Sequoia in RHEL 10 instead of GPG
  • New Profile for RHEL10: BSI
  • Move RHEL Control files to product files
  • Update RHEL 9 CCN profile
  • Various updates for SLE 12/15

spacecmd was updated to version 5.2.10:

• Version 5.2.10:
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9:
  • Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks…

This update fixes the following issues:

mgr-push:

• Version 5.2.5-0
  • Remove token based authentication mechanism for package_push (bsc#1230949)

spacecmd:

• Version 5.2.10-0
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9-0
  • Update translation strings

spacewalk-client-tools:

• Version 5.2.7-0
  • Update translation strings

venv-salt-minion:

• CVE-2026-13346: Arbitrary file installation via malicious package indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
• CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in configparser (bsc#1269066, gh#python/cpython#143927)
• CVE-2026-1502: reject CR/LF in HTTP tunnel request headers (bsc#1261969, gh#python/cpython#146211)
• CVE-2026-3276: Fix O(n^2) canonical ordering in unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
• CVE-2026-4360: Pass filter_function to TarFile._extract_one() during .extract() (bsc#1269959, gh#python/cpython#151987)
• CVE-2026-4786: fix webbrowser %action substitution bypass of dash-prefix check (bsc#1262319, gh#python/cpython#148169)
• CVE-2026-6019: protect against HTML injection by Base64-encoding cookie values embedded in JS (bsc#1262654, gh#python/cpython#90309)
• CVE-2026-6100: prevent dangling pointer, which can end in the use-after-free error (bsc#1262098, gh#python/cpython#148395)
• CVE-2026-7210: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (bsc#1264962, gh#python/cpython#149018)
• CVE-2026-7774: tarfile.data_filter: validate written link target (bsc#1267821, gh#149486)
• CVE-2026-8328: Make ftplib not trust the PASV response (bsc#1265268)
• CVE-2026-11940: fix the symlink escape via tarfile hardlink-extraction fallback (bsc#1268977)
• CVE-2026-11972: Make tarfile._Stream.seek break at EOF (bsc#1269788, gh#python/cpython#151981)
• CVE-2026-15308: Fix quadratic complexity in incremental parsing in HTMLParser (bsc#1271192, gh#python/cpython#153030)
• CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (bsc#1266669)
• CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442)
• CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
• CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599, gh#pypa/pip#13777)
• CVE-2024-22195: Fix compiler error when checking if required blocks in parent templates are xmlattr filter does not allow keys with spaces. (bsc#1218722)
• CVE-2026-45409: Specially crafted inputs to idna.encode() can bypass earlier security fix (bsc#1265413)
• CVE-2026-44431: sensitive information disclosure due to sensitive headers being forwarded across origins in proxied low-level redirects (bsc#1265267)
• CVE-2026-49825: The known link attributes in lxml.html.defs.link_attrs were missing xlink:href, which can be used for URL bypass attributes in embedded SVG/MathML/etc. content. (bsc#1270285) https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f
• CVE-2026-41066: This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser. (bsc#1263254)
• CVE-2026-3446: Preventing ignoring excess Base64 data after the first padded quad in non-strict (default) mode. (bsc#1261970, gh#python/cpython#145264)
• CVE-2026-3479: pkgutil.get_data() has the same security model as open(). The documented limitations ensure compatibility with non-filesystem loaders; Python doesn't check that. (bsc#1259989, gh#python/cpython#146121)
• CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1271428)
• CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
• CVE-2026-49854: out-of-bounds…

This update fixes the following issues:

mgr-push was updated to version 5.2.5:

• Removed token based authentication mechanism for package_push (bsc#1230949)

spacecmd was updated to version 5.2.10:

• Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Updated translation strings

spacewalk-client-tools was updated to version 5.2.7::

• Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)
  • CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)
  • CVE-2026-41066: Fixed leakage of private system data via…

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

• Security issues:

  • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
  • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
  • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
  • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
  • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
  • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
  • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
  • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
  • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
  • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
  • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
  • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
  • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

• Bug fixes and changes:

  • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
  • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
  • Native Histograms are no longer experimental. They are fully supported for production workloads.
  • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
  • TSDB compaction speed optimized by improving the block merging algorithm.
  • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
  • Added new metrics to monitor the health of the rule evaluation engine.
  • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
  • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
  • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
  • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
  • Support exporting TSDB blocks directly to cloud storage via the admin API.
  • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
  • Significant query performance boost for high-cardinality regex matchers.
  • Introduce a new UI interface for safely deleting specific time series data directly.
  • Added dynamic relabeling actions to extract substrings using regex capture groups.
  • Fixed UI displaying incorrect time ranges after a timezone change.
  • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

• Security issues:

  • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
  • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…