CVE-2025-11468

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

In CPython's email module, when folding a long comment containing exclusively unfoldable characters, the parentheses are not preserved. This could be exploited to inject headers into email messages in scenarios where email addresses are user-controlled and not sanitized.(CVE-2025-11468)

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.(CVE-2025-15282)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

In CPython's email module, when folding a long comment containing exclusively unfoldable characters, the parentheses are not preserved. This could be exploited to inject headers into email messages in scenarios where email addresses are user-controlled and not sanitized.(CVE-2025-11468)

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.(CVE-2025-15282)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

In CPython's email module, when folding a long comment containing exclusively unfoldable characters, the parentheses are not preserved. This could be exploited to inject headers into email messages in scenarios where email addresses are user-controlled and not sanitized.(CVE-2025-11468)

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.(CVE-2025-15282)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

In CPython's email module, when folding a long comment containing exclusively unfoldable characters, the parentheses are not preserved. This could be exploited to inject headers into email messages in scenarios where email addresses are user-controlled and not sanitized.(CVE-2025-11468)

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.

This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.

The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars.(CVE-2025-12781)

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.(CVE-2025-15282)

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.(CVE-2025-15367)

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.(CVE-2026-0672)

The wsgiref.headers.Headers module has an HTTP header injection vulnerability where user-controlled header names and values containing newlines can allow injecting malicious HTTP headers.(CVE-2026-0865)

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".(CVE-2026-1299)

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

• CVE-2025-8291: fix zipfile ZIP64 EOCD Locator offset validation
• CVE-2025-6069: fix quadratic complexity in HTMLParser
• CVE-2025-4516: fix use-after-free in unicode-escape decoder with error handler
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code
• CVE-2026-3479: reject invalid resource arguments in pkgutil.get_data()
• CVE-2025-1795: fix email header list separator incorrectly encoded during folding
• CVE-2026-0672: reject control characters in http cookies
• CVE-2025-15282: reject control characters in data URL mediatypes
• CVE-2026-3644: reject control characters in http.cookies.Morsel.update(), |=, unpickling, and js_output()
• CVE-2026-4224: avoid unbound C recursion in conv_content_model in pyexpat.c
• CVE-2025-11468: preserve parens when folding email comments to prevent header injection

• CVE-2025-1795: fix incorrect parsing of email addresses with special chars
• CVE-2025-4516: fix use-after-free in unicode-escape decoder with non-strict error handler
• CVE-2025-6069: fix quadratic complexity in HTMLParser special input
• CVE-2025-8291: fix zip64 end-of-central-directory record validation
• CVE-2025-11468: fix incorrect parsing of empty email display names
• CVE-2025-15282: fix control character injection in data: URL mediatype in urllib.request.DataHandler
• CVE-2024-5642: fix buffer over-read in ssl.SSLContext.set_npn_protocols with empty list

• CVE-2025-15282: reject control characters in data: URL mediatypes
• CVE-2025-11468: preserve parens when folding email comments to prevent header injection

• CVE-2026-4224: avoid unbound C recursion in conv_content_model in pyexpat
• CVE-2026-3644: reject control characters in http.cookies.Morsel.update()
• CVE-2026-0672: reject control characters in http.cookies.Morsel
• CVE-2025-8291: check consistency of zip64 end of central directory record
• CVE-2025-6069: fix quadratic complexity in processing special input in HTMLParser
• CVE-2025-4516: fix use-after-free in the unicode-escape decoder with error handler
• CVE-2025-15282: reject control characters in data URL mediatypes
• CVE-2025-11468: preserve parenthesis when folding email comments
• CVE-2026-3479: reject invalid resource arguments in pkgutil.get_data()
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code
• CVE-2024-5642: disallow setting an empty list for ssl NPN protocols

Please see the references for additional information about vulnerabilities.

These are all security issues fixed in the python314-3.14.2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~a3-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.19-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.14-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.12-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.12-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python313 fixes the following issues:

Update to version 3.13.12.

Security issues fixed:

• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
• CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in BytesGenerator (bsc#1257181).

Other updates and bugfixes:

• Update to version 3.13.12.

  • Library

    • gh-144380: Improve performance of io.BufferedReader line iteration by ~49%.
    • gh-144169: Fix three crashes when non-string keyword arguments are supplied to objects in the ast module.
    • gh-144100: Fixed a crash in ctypes when using a deprecated POINTER(str) type in argtypes. Instead of aborting, ctypes now raises a proper Python exception when the pointer target type is unresolved.
    • gh-144050: Fix stat.filemode() in the pure-Python implementation to avoid misclassifying invalid mode values as block devices.
    • gh-144023: Fixed validation of file descriptor 0 in posix functions when used with follow_symlinks parameter.
    • gh-143999: Fix an issue where inspect.getgeneratorstate() and inspect.getcoroutinestate() could fail for generators wrapped by types.coroutine() in the suspended state.
    • gh-143706: Fix multiprocessing forkserver so that sys.argv is correctly set before main is preloaded. Previously, sys.argv was empty during main module import in forkserver child processes. This fixes a regression introduced in 3.13.8 and 3.14.1. Root caused by Aaron Wieczorek, test provided by Thomas Watson, thanks!
    • gh-143638: Forbid reentrant calls of the pickle.Pickler and pickle.Unpickler methods for the C implementation. Previously, this could cause crash or data corruption, now concurrent calls of methods of the same object raise RuntimeError.
    • gh-78724: Raise RuntimeError's when user attempts to call methods on half-initialized Struct objects, For example, created by Struct.new(Struct). Patch by Sergey B Kirpichev.
    • gh-143602: Fix a inconsistency issue in write() that leads to unexpected buffer overwrite by deduplicating the buffer exports.
    • gh-143547: Fix sys.unraisablehook() when the hook raises an exception and changes sys.unraisablehook(): hold a strong reference to the old hook. Patch by Victor Stinner.
    • gh-143378: Fix use-after-free crashes when a BytesIO object is concurrently mutated during write() or writelines().
    • gh-143346: Fix incorrect wrapping of the Base64 data in plistlib._PlistWriter when the indent contains a mix of tabs and spaces.
    • gh-143310: tkinter: fix a crash when a Python list is mutated during the conversion to a Tcl object (e.g., when setting a Tcl variable). Patch by Benedikt Tran.
    • gh-143309: Fix a crash in os.execve() on non-Windows platforms when given a custom environment mapping which is then mutated during parsing. Patch by Benedikt Tran.
    • gh-143308: pickle: fix use-after-free crashes when a PickleBuffer is concurrently mutated by a custom buffer callback during pickling. Patch by Benedikt Tran and Aaron Wieczorek.
    • gh-143237: Fix support of named pipes in the rotating logging handlers.
    • gh-143249: Fix possible buffer leaks in Windows overlapped I/O on error handling.
    • gh-143241: zoneinfo: fix infinite loop in ZoneInfo.from_file when parsing a malformed TZif file. Patch by Fatih Celik. -…

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

Root has patched CVE-2025-11468 in the rootio-python3.11 package for Root:Debian:12. Multiple fixed versions available.

This update for python36 fixes the following issues:

• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).

This update for python310 fixes the following issues:

• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).

This update for python313 fixes the following issues:

Update to Python 3.13.12

• CVE-2026-0672: Fixed a HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel. (bsc#1257031)
• CVE-2026-0865: Fixed a bug where a user-controlled header containing newlines can allow injecting HTTP headers. (bsc#1257042)
• CVE-2025-15282: Fixed a bug where a user-controlled data URLs parsed may allow injecting headers. (bsc#1257046)
• CVE-2025-11468: Fixed a header injection when folding a long comment in an email header containing exclusively unfoldable characters. (bsc#1257029)
• CVE-2026-1299: Fixed header injection when an email is serialized due to improper newline quoting in BytesGenerator: Fixed a header injection when folding a long comment in an email header containing exclusively unfoldable characters. (bsc#1257029)

This update for python39 fixes the following issues:

• CVE-2025-11468: Fixed a header injection when folding a long comment in an email header containing exclusively unfoldable characters. (bsc#1257029)
• CVE-2026-0672: Fixed a HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel. (bsc#1257031)
• CVE-2026-0865: Fixed a bug where a user-controlled header containing newlines can allow injecting HTTP headers. (bsc#1257042)
• CVE-2025-15282: Fixed a bug where a user-controlled data URLs parsed may allow injecting headers. (bsc#1257046)
• CVE-2025-15366: Fixed a bug wherer a user-controlled command can allow additional commands injected using newlines. (bsc#1257044)
• CVE-2025-15367: Fixed control characters which may allow the injection of additional commands. (bsc#1257041)

This update for python312 fixes the following issues:

• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).

This update for python3 fixes the following issues:

• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).

This update for python3 fixes the following issues:

• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).

This update for python311 fixes the following issues:

• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2025-12781: inadequate parameter check can cause data integrity issues (bsc#1257108).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).

This update for python311 fixes the following issues:

• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2025-12781: inadequate parameter check can cause data integrity issues (bsc#1257108).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).

This update for python310 fixes the following issues:

Update to Python 3.10.20:

• CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
• CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
• CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
• CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
• CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
• CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
• CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042).
• CVE-2026-1299: header injection when an email is serialized due to improper newline quoting (bsc#1257181).
• CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).

Changelog:

• Update to 3.10.20:
• gh-144125: BytesGenerator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
• gh-143935: Fixed a bug in the folding of comments when flattening an email message using a modern email policy. Comments consisting of a very long sequence of non-foldable characters could trigger a forced line wrap that omitted the required leading space on the continuation line, causing the remainder of the comment to be interpreted as a new header field. This enabled header injection with carefully crafted inputs (bsc#1257029 CVE-2025-11468).
• gh-143925: Reject control characters in data: URL media types.
• gh-143919: Reject control characters in http.cookies.Morsel fields and values (bsc#1257031, CVE-2026-0672).
• gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042, CVE-2026-0865).
• gh-142145: Remove quadratic behavior in xml.minidom node ID cache clearing. In order to do this without breaking existing users, we also add the ownerDocument attribute to xml.dom.minidom elements and attributes created by directly instantiating the Element or Attr class. Note that this way of creating nodes is not supported; creator functions like xml.dom.Document.documentElement() should be used instead (bsc#1254997, CVE-2025-12084).
• gh-137836: Add support of the 'plaintext' element, RAWTEXT elements 'xmp', 'iframe', 'noembed' and 'noframes', and optionally RAWTEXT element 'noscript' in html.parser.HTMLParser.
• gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by B�n�dikt Tran.
• gh-136065: Fix quadratic complexity in os.path.expandvars() (bsc#1252974, CVE-2025-6075).
• gh-119451: Fix a potential memory denial of service in the http.client module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes (CVE-2025-13836, bsc#1254400).
• gh-119452: Fix a potential memory denial of service in the http.server module. When a malicious user is connected to the CGI server on Windows, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes.
• gh-119342: Fix a potential memory denial of service in the plistlib module. When reading a Plist file received from untrusted source, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes (bsc#1254401, CVE-2025-13837).
• Library
• gh-144833: Fixed a use-after-free in ssl when SSL_new() …

This update for python312 fixes the following issues:

Update to Python 3.12.13:

• CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
• CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
• CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
• CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
• CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
• CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042).
• CVE-2026-1299: header injection when an email is serialized due to improper newline quoting (bsc#1257181).
• CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).

Changelog:

• gh-144125: BytesGenerator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
• gh-143935: Fixed a bug in the folding of comments when flattening an email message using a modern email policy. Comments consisting of a very long sequence of non-foldable characters could trigger a forced line wrap that omitted the required leading space on the continuation line, causing the remainder of the comment to be interpreted as a new header field. This enabled header injection with carefully crafted inputs (bsc#1257029 CVE-2025-11468).
• gh-143925: Reject control characters in data: URL media types (bsc#1257046, CVE-2025-15282).
• gh-143919: Reject control characters in http.cookies.Morsel fields and values (bsc#1257031, CVE-2026-0672).
• gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042, CVE-2026-0865).
• gh-142145: Remove quadratic behavior in xml.minidom node ID cache clearing. In order to do this without breaking existing users, we also add the ownerDocument attribute to xml.dom.minidom elements and attributes created by directly instantiating the Element or Attr class. Note that this way of creating nodes is not supported; creator functions like xml.dom.Document.documentElement() should be used instead (bsc#1254997, CVE-2025-12084).
• gh-137836: Add support of the 'plaintext' element, RAWTEXT elements 'xmp', 'iframe', 'noembed' and 'noframes', and optionally RAWTEXT element 'noscript' in html.parser.HTMLParser.
• gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by B�n�dikt Tran.
• gh-136065: Fix quadratic complexity in os.path.expandvars() (bsc#1252974, CVE-2025-6075).
• gh-119451: Fix a potential memory denial of service in the http.client module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes (CVE-2025-13836, bsc#1254400).
• gh-119452: Fix a potential memory denial of service in the http.server module. When a malicious user is connected to the CGI server on Windows, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes.
• gh-119342: Fix a potential memory denial of service in the plistlib module. When reading a Plist file received from untrusted source, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes …

This update for python311 fixes the following issues:

Update to python 3.11.15:

• CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
• CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
• CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
• CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
• CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
• CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042).
• CVE-2026-1299: header injection when an email is serialized due to improper newline quoting (bsc#1257181).
• CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).

Changelog:

• gh-144125: BytesGenerator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
• gh-143935: Fixed a bug in the folding of comments when flattening an email message using a modern email policy. Comments consisting of a very long sequence of non-foldable characters could trigger a forced line wrap that omitted the required leading space on the continuation line, causing the remainder of the comment to be interpreted as a new header field. This enabled header injection with carefully crafted inputs (bsc#1257029 CVE-2025-11468).
• gh-143925: Reject control characters in data: URL media types (bsc#1257046, CVE-2025-15282).
• gh-143919: Reject control characters in http.cookies.Morsel fields and values (bsc#1257031, CVE-2026-0672).
• gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042, CVE-2026-0865).
• gh-142145: Remove quadratic behavior in xml.minidom node ID cache clearing. In order to do this without breaking existing users, we also add the ownerDocument attribute to xml.dom.minidom elements and attributes created by directly instantiating the Element or Attr class. Note that this way of creating nodes is not supported; creator functions like xml.dom.Document.documentElement() should be used instead (bsc#1254997, CVE-2025-12084).
• gh-137836: Add support of the 'plaintext' element, RAWTEXT elements 'xmp', 'iframe', 'noembed' and 'noframes', and optionally RAWTEXT element 'noscript' in html.parser.HTMLParser.
• gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by Benedikt Tran.
• gh-136065: Fix quadratic complexity in os.path.expandvars() (bsc#1252974, CVE-2025-6075).
• gh-119451: Fix a potential memory denial of service in the http.client module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes (CVE-2025-13836, bsc#1254400).
• gh-119452: Fix a potential memory denial of service in the http.server module. When a malicious user is connected to the CGI server on Windows, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes.
• gh-119342: Fix a potential memory denial of service in the plistlib module. When reading a Plist file received from untrusted source, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes …

This update for python311 fixes the following issues:

• Updated to Python 3.11.15
• CVE-2025-6075: If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables (bsc#1252974).
• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2025-12084: cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (bsc#1254997).
• CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
• CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length (bsc#1254400).
• CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues (bsc#1254401).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
• CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in BytesGenerator (bsc#1257181).
• CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).
• CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
• CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
• CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
• CVE-2026-4519: leading dashes in URLs are accepted by the webbrowser.open() API and allow for web browser command line option injection (bsc#1260026).

This update for python313 fixes the following issues:

Update to version 3.13.12.

Security issues fixed:

• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
• CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in BytesGenerator (bsc#1257181).

Other updates and bugfixes:

• Update to version 3.13.12.

  • Library

    • gh-144380: Improve performance of io.BufferedReader line iteration by ~49%.
    • gh-144169: Fix three crashes when non-string keyword arguments are supplied to objects in the ast module.
    • gh-144100: Fixed a crash in ctypes when using a deprecated POINTER(str) type in argtypes. Instead of aborting, ctypes now raises a proper Python exception when the pointer target type is unresolved.
    • gh-144050: Fix stat.filemode() in the pure-Python implementation to avoid misclassifying invalid mode values as block devices.
    • gh-144023: Fixed validation of file descriptor 0 in posix functions when used with follow_symlinks parameter.
    • gh-143999: Fix an issue where inspect.getgeneratorstate() and inspect.getcoroutinestate() could fail for generators wrapped by types.coroutine() in the suspended state.
    • gh-143706: Fix multiprocessing forkserver so that sys.argv is correctly set before main is preloaded. Previously, sys.argv was empty during main module import in forkserver child processes. This fixes a regression introduced in 3.13.8 and 3.14.1. Root caused by Aaron Wieczorek, test provided by Thomas Watson, thanks!
    • gh-143638: Forbid reentrant calls of the pickle.Pickler and pickle.Unpickler methods for the C implementation. Previously, this could cause crash or data corruption, now concurrent calls of methods of the same object raise RuntimeError.
    • gh-78724: Raise RuntimeError's when user attempts to call methods on half-initialized Struct objects, For example, created by Struct.new(Struct). Patch by Sergey B Kirpichev.
    • gh-143602: Fix a inconsistency issue in write() that leads to unexpected buffer overwrite by deduplicating the buffer exports.
    • gh-143547: Fix sys.unraisablehook() when the hook raises an exception and changes sys.unraisablehook(): hold a strong reference to the old hook. Patch by Victor Stinner.
    • gh-143378: Fix use-after-free crashes when a BytesIO object is concurrently mutated during write() or writelines().
    • gh-143346: Fix incorrect wrapping of the Base64 data in plistlib._PlistWriter when the indent contains a mix of tabs and spaces.
    • gh-143310: tkinter: fix a crash when a Python list is mutated during the conversion to a Tcl object (e.g., when setting a Tcl variable). Patch by Benedikt Tran.
    • gh-143309: Fix a crash in os.execve() on non-Windows platforms when given a custom environment mapping which is then mutated during parsing. Patch by Benedikt Tran.
    • gh-143308: pickle: fix use-after-free crashes when a PickleBuffer is concurrently mutated by a custom buffer callback during pickling. Patch by Benedikt Tran and Aaron Wieczorek.
    • gh-143237: Fix support of named pipes in the rotating logging handlers.
    • gh-143249: Fix possible buffer leaks in Windows overlapped I/O on error handling.
    • gh-143241: zoneinfo: fix infinite loop in ZoneInfo.from_file when parsing a malformed TZif file. Patch by Fatih Celik. -…

This update for python313 fixes the following issues:

Update to version 3.13.12.

Security issues fixed:

• CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
• CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
• CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
• CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
• CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in BytesGenerator (bsc#1257181).

Other updates and bugfixes:

• Update to version 3.13.12.

  • Library

    • gh-144380: Improve performance of io.BufferedReader line iteration by ~49%.
    • gh-144169: Fix three crashes when non-string keyword arguments are supplied to objects in the ast module.
    • gh-144100: Fixed a crash in ctypes when using a deprecated POINTER(str) type in argtypes. Instead of aborting, ctypes now raises a proper Python exception when the pointer target type is unresolved.
    • gh-144050: Fix stat.filemode() in the pure-Python implementation to avoid misclassifying invalid mode values as block devices.
    • gh-144023: Fixed validation of file descriptor 0 in posix functions when used with follow_symlinks parameter.
    • gh-143999: Fix an issue where inspect.getgeneratorstate() and inspect.getcoroutinestate() could fail for generators wrapped by types.coroutine() in the suspended state.
    • gh-143706: Fix multiprocessing forkserver so that sys.argv is correctly set before main is preloaded. Previously, sys.argv was empty during main module import in forkserver child processes. This fixes a regression introduced in 3.13.8 and 3.14.1. Root caused by Aaron Wieczorek, test provided by Thomas Watson, thanks!
    • gh-143638: Forbid reentrant calls of the pickle.Pickler and pickle.Unpickler methods for the C implementation. Previously, this could cause crash or data corruption, now concurrent calls of methods of the same object raise RuntimeError.
    • gh-78724: Raise RuntimeError's when user attempts to call methods on half-initialized Struct objects, For example, created by Struct.new(Struct). Patch by Sergey B Kirpichev.
    • gh-143602: Fix a inconsistency issue in write() that leads to unexpected buffer overwrite by deduplicating the buffer exports.
    • gh-143547: Fix sys.unraisablehook() when the hook raises an exception and changes sys.unraisablehook(): hold a strong reference to the old hook. Patch by Victor Stinner.
    • gh-143378: Fix use-after-free crashes when a BytesIO object is concurrently mutated during write() or writelines().
    • gh-143346: Fix incorrect wrapping of the Base64 data in plistlib._PlistWriter when the indent contains a mix of tabs and spaces.
    • gh-143310: tkinter: fix a crash when a Python list is mutated during the conversion to a Tcl object (e.g., when setting a Tcl variable). Patch by Benedikt Tran.
    • gh-143309: Fix a crash in os.execve() on non-Windows platforms when given a custom environment mapping which is then mutated during parsing. Patch by Benedikt Tran.
    • gh-143308: pickle: fix use-after-free crashes when a PickleBuffer is concurrently mutated by a custom buffer callback during pickling. Patch by Benedikt Tran and Aaron Wieczorek.
    • gh-143237: Fix support of named pipes in the rotating logging handlers.
    • gh-143249: Fix possible buffer leaks in Windows overlapped I/O on error handling.
    • gh-143241: zoneinfo: fix infinite loop in ZoneInfo.from_file when parsing a malformed TZif file. Patch by Fatih Celik. -…

This update for python311 fixes the following issues:

• CVE-2025-11468: preserving parens when folding comments in email headers. (bsc#1257029)
• CVE-2026-0672: rejects control characters in http cookies. (bsc#1257031)
• CVE-2026-0865: rejecting control characters in wsgiref.headers.Headers, which could be abused for injecting false HTTP headers. (bsc#1257042)
• CVE-2025-15366: basically the same as the previous patch for IMAP protocol. (bsc#1257044)
• CVE-2025-15282: basically the same as the previous patch for urllib library. (bsc#1257046)
• CVE-2025-15367: basically the same as the previous patch for poplib library. (bsc#1257041)
• CVE-2025-12781: fix decoding with non-standard Base64 alphabet (bsc#1257108)

This update for python311 fixes the following issues:

• CVE-2025-11468: preserving parens when folding comments in email headers. (bsc#1257029)
• CVE-2026-0672: rejects control characters in http cookies. (bsc#1257031)
• CVE-2026-0865: rejecting control characters in wsgiref.headers.Headers, which could be abused for injecting false HTTP headers. (bsc#1257042)
• CVE-2025-15366: basically the same as the previous patch for IMAP protocol. (bsc#1257044)
• CVE-2025-15282: basically the same as the previous patch for urllib library. (bsc#1257046)
• CVE-2025-15367: basically the same as the previous patch for poplib library. (bsc#1257041)
• CVE-2025-12781: fix decoding with non-standard Base64 alphabet (bsc#1257108)

This update for python311 fixes the following issues:

Updated to Python 3.11.15:

• CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
• CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
• CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
• CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
• CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
• CVE-2025-15282: control characters in URL media types data (bsc#1257046).
• CVE-2026-0672: control characters in http.cookies.Morsel fields and values (bsc#1257031).
• CVE-2026-0865: C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042).