CVE-2026-6019

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.(CVE-2026-6019)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.(CVE-2026-6019)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.(CVE-2026-6019)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

• python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

• [9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:Rocky Linux-180642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

• python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

• [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:Rocky Linux-176147)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-6019 in the python3.9 package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-6019 in the python3.11 package for Root:Debian:12. Multiple fixed versions available.

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
• python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

• [9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-180642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
• python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

• [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

• CVE-2026-6019: base64-encode cookie values in http.cookies.Morsel.js_output() to prevent script-context injection

• CVE-2026-6019: base64-encode cookie values embedded in JavaScript in http.cookies.Morsel.js_output() to prevent script injection

• CVE-2026-6019: base64-encode cookie values embedded in JS by http.cookies.Morsel.js_output() to avoid injection

• CVE-2026-6019: base64-encode cookie values in http.cookies.Morsel.js_output() to prevent script-context injection

These are all security issues fixed in the python310-3.10.20-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~a8-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.13-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.15-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.13-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python313, python3 fixes the following issues:

Changes in python313:

Update to 3.13.14:

• Security

  • gh-151159: Bumps the OpenSSL version to 3.0.21 on Android.
  • gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
  • gh-149835: shutil.move() now resolves symlinks via os.path.realpath() when checking whether the destination is inside the source directory, preventing a symlink-based bypass of that guard.
  • gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE 2026-45186.
  • gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report.
  • gh-149486: tarfile.data_filter() now validates link targets using the same normalised value that is written to disk, strips trailing separators from the member name when resolving a symlink’s directory, and rejects link members that would replace the destination directory itself. This closes several path-traversal bypasses of the data extraction filter.
  • gh-149079: Fix a potential denial of service in unicodedata.normalize(). The canonical ordering step of Unicode normalization used a quadratic-time insertion sort for reordering combining characters, which could be exploited with crafted input containing many combining characters in non-canonical order. Replaced with a linear-time counting sort for long runs.
  • gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later.
  • gh-149017: Update bundled libexpat to version 2.8.0.
  • gh-90309: Base64-encode values when embedding cookies to JavaScript using the http.cookies.BaseCookie.js_output() method to avoid injection and escaping. (bsc#1262654, CVE-2026-6019)
  • gh-148808: Added buffer boundary check when using nbytes parameter with asyncio.AbstractEventLoop.sock_recvfrom_into(). Only relevant for Windows and the asyncio.ProactorEventLoop.
  • gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal zlib._ZlibDecompressor when memory allocation fails with MemoryError, which could let a subsequent decompress() call read or write through a stale pointer to the already-released caller buffer. (bsc#1262098, CVE-2026-6100, seems like it has been incompletely applied gh#python/cpython#151605)
  • gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to pass the dash-prefix safety check (bsc#1262098, CVE-2026-6100).
  • gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows which allowed to write files outside of the destination tree if the patch in the archive contains a Windows drive prefix. Now such invalid paths will be skipped. Files containing “..” in the name (like “foo..bar”) are no longer skipped.
  • gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration line with many whitespace characters could cause excessive CPU usage.
  • gh-146211: Reject CR/LF characters in tunnel request headers for the HTTPConnection.set_tunnel() method. (bsc#1261969, CVE-2026-1502)

• Core and…

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

This update for python3 fixes the following issues:

• CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to misinterpretation of tar archives (bsc#1259611).
• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that could be processed (bsc#1261970).
• CVE-2026-3479: improper resource argument validation in pkgutil.get_data() can lead to path traversal (bsc#1259989).
• CVE-2026-3644: incomplete control character validation in http.cookies can lead to input validation bypass (bsc#1259734).
• CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to C stack overflow (bsc#1259735).
• CVE-2026-4519: failure to sanitize leading dashes in URLs in the webbrowser.open() API can lead to web browser command line option injection (bsc#1260026).
• CVE-2026-4786: URLs prefixed with %action can pass the dash-prefix safety check and allow for command injection (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize characters in cookie values embedded in JS (bsc#1262654).
• CVE-2026-6100: use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when process is under memory pressure(bsc#1262098).

This update for python39 fixes the following issues:

Security issues fixed:

• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that could be processed (bsc#1261970).
• CVE-2026-3479: improper resource argument validation in pkgutil.get_data() can lead to path traversal (bsc#1259989).
• CVE-2026-4786: URLs prefixed with %action can pass the dash-prefix safety check and allow for command injection (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize characters in cookie values embedded in JS (bsc#1262654).
• CVE-2026-6100: use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when process is under memory pressure(bsc#1262098).

Other updates and bugfixes:

• Rewrite structure of Python interpreter packages. python3* symbols should be now provided by real python3 packages and its subpackages instead of the virtual provides (bsc#1258364).

This update for python3 fixes the following issue:

• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that could be processed (bsc#1261970).
• CVE-2026-4786: URLs prefixed with %action can pass the dash-prefix safety check and allow for command injection (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize characters in cookie values embedded in JS (bsc#1262654).
• CVE-2026-6100: use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when process is under memory pressure(bsc#1262098).

This update for python310 fixes the following issues

Security issues:

• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3446: base64 decoding stops at first padded quad by default (bsc#1261970).
• CVE-2026-4786: incomplete mitigation of , %action expansion for command injection to webbrowser.open() (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize characters in cookie values embedded in JS (bsc#1262654).
• CVE-2026-6100: arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).

Non security issue:

• Conflicts between different versions of Python (bsc#1258364).

This update for python312 fixes the following issues

• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize characters in cookie values embedded in JS (bsc#1262654).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).

This update for python313, python3 fixes the following issues:

Changes in python313:

Update to 3.13.14:

• Security

  • gh-151159: Bumps the OpenSSL version to 3.0.21 on Android.
  • gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
  • gh-149835: shutil.move() now resolves symlinks via os.path.realpath() when checking whether the destination is inside the source directory, preventing a symlink-based bypass of that guard.
  • gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE 2026-45186.
  • gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report.
  • gh-149486: tarfile.data_filter() now validates link targets using the same normalised value that is written to disk, strips trailing separators from the member name when resolving a symlink’s directory, and rejects link members that would replace the destination directory itself. This closes several path-traversal bypasses of the data extraction filter.
  • gh-149079: Fix a potential denial of service in unicodedata.normalize(). The canonical ordering step of Unicode normalization used a quadratic-time insertion sort for reordering combining characters, which could be exploited with crafted input containing many combining characters in non-canonical order. Replaced with a linear-time counting sort for long runs.
  • gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later.
  • gh-149017: Update bundled libexpat to version 2.8.0.
  • gh-90309: Base64-encode values when embedding cookies to JavaScript using the http.cookies.BaseCookie.js_output() method to avoid injection and escaping. (bsc#1262654, CVE-2026-6019)
  • gh-148808: Added buffer boundary check when using nbytes parameter with asyncio.AbstractEventLoop.sock_recvfrom_into(). Only relevant for Windows and the asyncio.ProactorEventLoop.
  • gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal zlib._ZlibDecompressor when memory allocation fails with MemoryError, which could let a subsequent decompress() call read or write through a stale pointer to the already-released caller buffer. (bsc#1262098, CVE-2026-6100, seems like it has been incompletely applied gh#python/cpython#151605)
  • gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to pass the dash-prefix safety check (bsc#1262098, CVE-2026-6100).
  • gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows which allowed to write files outside of the destination tree if the patch in the archive contains a Windows drive prefix. Now such invalid paths will be skipped. Files containing “..” in the name (like “foo..bar”) are no longer skipped.
  • gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration line with many whitespace characters could cause excessive CPU usage.
  • gh-146211: Reject CR/LF characters in tunnel request headers for the HTTPConnection.set_tunnel() method. (bsc#1261969, CVE-2026-1502)

• Core and…

This update for python311 fixes the following issues:

Security issues fixed:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters (bsc#1262654).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

Non security issues fixed:

• Regression in http.cookies (bsc#1263083).
• udplite was removed -> python fails in tests (bsc#1268375).
• Conflicts between different versions of Python (bsc#1258364).

This update for python311 fixes the following issues:

Security issues fixed:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters (bsc#1262654).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

Non security issues fixed:

• Regression in http.cookies (bsc#1263083).
• udplite was removed -> python fails in tests (bsc#1268375).
• Conflicts between different versions of Python (bsc#1258364).

This update for python fixes the following issues

• CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599).
• CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).
• CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters (bsc#1262654).
• CVE-2026-6100: arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
• CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442).

Changes for python:

• For SLE-12-SP1 use vendored libffi (bsc#1261652). We have libffi4.so from SP3 only.

This update for python313 fixes the following issues

Security issues:

• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
• CVE-2026-4786: [oss-security][] CPython: Incomplete mitigation of , %action expansion for command injection to webbrowser.open() (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize characters in cookie values embedded in JS (bsc#1262654).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).

Non security issue:

• Add missing BR crypto-policies-scripts (need for the fix of bsc#1211301).

This update for python, python-base, python-doc fixes the following issues

Security fixes:

• CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599).
• CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).
• CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
• CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters (bsc#1262654).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
• CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442).

Other fixes:

• For SLE-12 use vendored libffi (bsc#1261652).

This update for python311 fixes the following issues

• CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers or host (bsc#1261969).
• CVE-2026-4786: URLs containing %action can bypass mitigation that allows command injection via the webbrowser.open() API (bsc#1262319).
• CVE-2026-6019: HTML parser-sensitive sequence not neutralized by http.cookies.Morsel.js_output() (bsc#1262654).
• CVE-2026-6100: use-after-free in decompression modules when a memory allocation fails with a MemoryError and the decompression instance is re-used (bsc#1262098).