CVE-2026-1502

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.(CVE-2026-1502)

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.(CVE-2026-4786)

Use-after-free (UAF) was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.

The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a MemoryError is raised during decompression. Using the helper functions to one-shot decompress data such as lzma.decompress(), bz2.decompress(), gzip.decompress(), and zlib.decompress() are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.(CVE-2026-6100)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.(CVE-2026-1502)

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.(CVE-2026-4786)

Use-after-free (UAF) was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.

The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a MemoryError is raised during decompression. Using the helper functions to one-shot decompress data such as lzma.decompress(), bz2.decompress(), gzip.decompress(), and zlib.decompress() are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.(CVE-2026-6100)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.(CVE-2026-1502)

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.(CVE-2026-4786)

Use-after-free (UAF) was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.

The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a MemoryError is raised during decompression. Using the helper functions to one-shot decompress data such as lzma.decompress(), bz2.decompress(), gzip.decompress(), and zlib.decompress() are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.(CVE-2026-6100)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

• python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

• python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-1502 in the python3.9 package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-1502 in the python3.11 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-1502 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available.

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
• python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
• python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

• CVE-2026-1502: reject CR/LF in HTTP proxy tunnel host and headers

• CVE-2026-1502: fix CRLF injection in http.client._tunnel() — reject control characters in the tunnel host and reject CR/LF in tunnel-request header names and values

• CVE-2026-1502: reject CR/LF control characters in http.client._tunnel() host and request headers to prevent HTTP header injection

• CVE-2026-0672: reject control characters in http.cookies.Morsel keys/values
• CVE-2026-3644: extend control-character rejection to Morsel.update(), |=, and setstate
• CVE-2026-4224: avoid unbound C recursion in pyexpat conv_content_model for deeply nested DTDs
• CVE-2026-1502: reject CR/LF in HTTP tunnel request headers and tunnel host

Please see the references for additional information about vulnerabilities.

These are all security issues fixed in the python310-3.10.20-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~a8-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.13-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.15-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.13-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python313, python3 fixes the following issues:

Changes in python313:

Update to 3.13.14:

• Security

  • gh-151159: Bumps the OpenSSL version to 3.0.21 on Android.
  • gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
  • gh-149835: shutil.move() now resolves symlinks via os.path.realpath() when checking whether the destination is inside the source directory, preventing a symlink-based bypass of that guard.
  • gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE 2026-45186.
  • gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report.
  • gh-149486: tarfile.data_filter() now validates link targets using the same normalised value that is written to disk, strips trailing separators from the member name when resolving a symlink’s directory, and rejects link members that would replace the destination directory itself. This closes several path-traversal bypasses of the data extraction filter.
  • gh-149079: Fix a potential denial of service in unicodedata.normalize(). The canonical ordering step of Unicode normalization used a quadratic-time insertion sort for reordering combining characters, which could be exploited with crafted input containing many combining characters in non-canonical order. Replaced with a linear-time counting sort for long runs.
  • gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later.
  • gh-149017: Update bundled libexpat to version 2.8.0.
  • gh-90309: Base64-encode values when embedding cookies to JavaScript using the http.cookies.BaseCookie.js_output() method to avoid injection and escaping. (bsc#1262654, CVE-2026-6019)
  • gh-148808: Added buffer boundary check when using nbytes parameter with asyncio.AbstractEventLoop.sock_recvfrom_into(). Only relevant for Windows and the asyncio.ProactorEventLoop.
  • gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal zlib._ZlibDecompressor when memory allocation fails with MemoryError, which could let a subsequent decompress() call read or write through a stale pointer to the already-released caller buffer. (bsc#1262098, CVE-2026-6100, seems like it has been incompletely applied gh#python/cpython#151605)
  • gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to pass the dash-prefix safety check (bsc#1262098, CVE-2026-6100).
  • gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows which allowed to write files outside of the destination tree if the patch in the archive contains a Windows drive prefix. Now such invalid paths will be skipped. Files containing “..” in the name (like “foo..bar”) are no longer skipped.
  • gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration line with many whitespace characters could cause excessive CPU usage.
  • gh-146211: Reject CR/LF characters in tunnel request headers for the HTTPConnection.set_tunnel() method. (bsc#1261969, CVE-2026-1502)

• Core and…

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

This update for python3 fixes the following issues:

• CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to misinterpretation of tar archives (bsc#1259611).
• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that could be processed (bsc#1261970).
• CVE-2026-3479: improper resource argument validation in pkgutil.get_data() can lead to path traversal (bsc#1259989).
• CVE-2026-3644: incomplete control character validation in http.cookies can lead to input validation bypass (bsc#1259734).
• CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to C stack overflow (bsc#1259735).
• CVE-2026-4519: failure to sanitize leading dashes in URLs in the webbrowser.open() API can lead to web browser command line option injection (bsc#1260026).
• CVE-2026-4786: URLs prefixed with %action can pass the dash-prefix safety check and allow for command injection (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize characters in cookie values embedded in JS (bsc#1262654).
• CVE-2026-6100: use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when process is under memory pressure(bsc#1262098).

This update for python39 fixes the following issues:

Security issues fixed:

• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that could be processed (bsc#1261970).
• CVE-2026-3479: improper resource argument validation in pkgutil.get_data() can lead to path traversal (bsc#1259989).
• CVE-2026-4786: URLs prefixed with %action can pass the dash-prefix safety check and allow for command injection (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize characters in cookie values embedded in JS (bsc#1262654).
• CVE-2026-6100: use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when process is under memory pressure(bsc#1262098).

Other updates and bugfixes:

• Rewrite structure of Python interpreter packages. python3* symbols should be now provided by real python3 packages and its subpackages instead of the virtual provides (bsc#1258364).

This update for python3 fixes the following issue:

• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that could be processed (bsc#1261970).
• CVE-2026-4786: URLs prefixed with %action can pass the dash-prefix safety check and allow for command injection (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize characters in cookie values embedded in JS (bsc#1262654).
• CVE-2026-6100: use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when process is under memory pressure(bsc#1262098).