{"id":"CVE-2026-15310","aliases":["ALPINE-CVE-2026-15310","AZL-98208","AZL-98217","BELL-CVE-2026-15310","BIT-libpython-2026-15310","BIT-python-2026-15310","BIT-python-min-2026-15310","CLSA-2026-1789735614","CLSA-2026-1789993238","CLSA-2026-1789995979","CLSA-2026-1790007232","CLSA-2026-1791377791","DEBIAN-CVE-2026-15310","EUVD-2026-65519","GHSA-xj79-6hh5-9w6q","OESA-2026-3755","OESA-2026-3756","OESA-2026-3757","OESA-2026-3920","PSF-2026-39","RHSA-2026:65505","RHSA-2026:65513","RHSA-2026:65525","RHSA-2026:65531","RHSA-2026:65567","SUSE-SU-2026:24138-1","SUSE-SU-2026:24280-1","SUSE-SU-2026:24325-1","SUSE-SU-2026:4396-1","SUSE-SU-2026:4534-1","SUSE-SU-2026:4630-1","SUSE-SU-2026:4743-1","SUSE-SU-2026:4744-1","SUSE-SU-2026:4754-1","SUSE-SU-2026:4809-1","SUSE-SU-2026:4941-1","SUSE-SU-2026:4946-1","UBUNTU-CVE-2026-15310","openSUSE-SU-2026:11748-1","openSUSE-SU-2026:11868-1","openSUSE-SU-2026:11886-1","openSUSE-SU-2026:11949-1","openSUSE-SU-2026:11950-1","openSUSE-SU-2026:11975-1"],"status":"published","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00526,"percentile":0.44896,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-08-25T15:07:58Z","modified":"2026-11-10T12:40:48Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"python3","fixed_in":["3.12.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"python3","fixed_in":["3.12.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"python3","fixed_in":["3.12.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"python3","fixed_in":["3.14.8-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python3","fixed_in":["3.12.15-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"python3","fixed_in":["3.11.16-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"python3","fixed_in":["3.12.14-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"python3","fixed_in":["3.14.7-r3"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"python3","fixed_in":["3.11.16-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"python3","fixed_in":["3.12.14-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"python3","fixed_in":["3.14.7-r3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libpython","fixed_in":["3.10.22","3.11.17","3.12.15","3.13.16","3.14.8"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python","fixed_in":["3.10.22","3.11.17","3.12.15","3.13.16","3.14.8"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python-min","fixed_in":["3.10.22","3.11.17","3.12.15","3.13.16","3.14.8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11","fixed_in":["3.11.2-2.el9_2.2.tuxcare.els37"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-debug","fixed_in":["3.11.2-2.el9_2.2.tuxcare.els37"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-devel","fixed_in":["3.11.2-2.el9_2.2.tuxcare.els37"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-idle","fixed_in":["3.11.2-2.el9_2.2.tuxcare.els37"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-libs","fixed_in":["3.11.2-2.el9_2.2.tuxcare.els37"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-test","fixed_in":["3.11.2-2.el9_2.2.tuxcare.els37"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-tkinter","fixed_in":["3.11.2-2.el9_2.2.tuxcare.els37"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python3.11","fixed_in":["3.11.2-6+deb12u9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python3.14","fixed_in":["3.14.7-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python3.15","fixed_in":["3.15.0~rc2-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"python3","fixed_in":["3.11.6-43.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python3","fixed_in":["3.9.9-59.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python3","fixed_in":["3.11.6-41.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python3","fixed_in":["3.11.6-42.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python313","fixed_in":["3.13.15-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.8-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.1-11"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-r0"},{"fixed":"3.11.16-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.10-r1"},{"fixed":"3.12.14-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.7-r3"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-r0"},{"fixed":"3.11.16-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.10-r1"},{"fixed":"3.12.14-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.7-r3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"libpython","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els17"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els17"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els17"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els17"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els17"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els17"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els17"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python-unversioned-command","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"platform-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els19"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"platform-python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els19"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"platform-python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els19"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els19"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els19"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els19"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els19"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els19"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"platform-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els27"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"platform-python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els27"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"platform-python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els27"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els27"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els27"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els27"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els27"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els27"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els37"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els37"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els37"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els37"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els37"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els37"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els37"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python3.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-6+deb12u9"}]}],"versions":["3.11.2-6","3.11.2-6+deb12u1","3.11.2-6+deb12u2","3.11.2-6+deb12u3","3.11.2-6+deb12u4","3.11.2-6+deb12u5","3.11.2-6+deb12u6","3.11.2-6+deb12u7","3.11.2-6+deb12u8"]},{"source":"osv","ecosystem":"Debian:13","package":"python3.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.11-1","3.13.12-1","3.13.14-1","3.13.15-1","3.13.18-1","3.13.5-2","3.13.5-2+deb13u1","3.13.5-2+deb13u2","3.13.5-2+deb13u3","3.13.5-2+deb13u4","3.13.5-2+deb13u5","3.13.6-1","3.13.7-1","3.13.8-1","3.13.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-3"}]}],"versions":["3.14.0-1","3.14.0-2","3.14.0-3","3.14.0-4","3.14.0-5","3.14.0~a7-1","3.14.0~b1-1","3.14.0~b2-1","3.14.0~b3-1","3.14.0~b4-1","3.14.0~rc1-1","3.14.0~rc2-1","3.14.0~rc3-1","3.14.2-1","3.14.3-1","3.14.3-2","3.14.3-3","3.14.3-4","3.14.3-5","3.14.4-1","3.14.4-2","3.14.5-1","3.14.5~rc1-1","3.14.6-1","3.14.7-1","3.14.7-2"]},{"source":"osv","ecosystem":"Debian:14","package":"python3.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0~rc2-1"}]}],"versions":["3.15.0~a8-1","3.15.0~a8-2","3.15.0~b1-1","3.15.0~b1-2","3.15.0~b1-3","3.15.0~b2-1","3.15.0~b3-1","3.15.0~b4-1","3.15.0~rc1-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-43.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.9-59.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-41.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-42.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-unversioned-command","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-freethreading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-freethreading-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-159998.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-159998.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-159998.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-159998.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-150400.9.102.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python312","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-150600.3.68.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python312-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-150600.3.68.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python312","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-150600.3.68.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python312-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-150600.3.68.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python310-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python310-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python310-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python310-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python36","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python36-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python36","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python36-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-25.199.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-25.199.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-25.199.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-25.199.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python313","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16-150700.4.61.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python313-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16-150700.4.61.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.5-8ubuntu3","2.7.5-8ubuntu4","2.7.6-2","2.7.6-2ubuntu1","2.7.6-3","2.7.6-3ubuntu1","2.7.6-4","2.7.6-4ubuntu1","2.7.6-5","2.7.6-7","2.7.6-8","2.7.6-8ubuntu0.2","2.7.6-8ubuntu0.3","2.7.6-8ubuntu0.4","2.7.6-8ubuntu0.5","2.7.6-8ubuntu0.6+esm2","2.7.6-8ubuntu0.6+esm3","2.7.6-8ubuntu0.6+esm5","2.7.6-8ubuntu0.6+esm6","2.7.6-8ubuntu0.6+esm7","2.7.6-8ubuntu0.6+esm8","2.7.6-8ubuntu0.6+esm9","2.7.6-8ubuntu0.6+esm10","2.7.6-8ubuntu0.6+esm11","2.7.6-8ubuntu0.6+esm12","2.7.6-8ubuntu0.6+esm13","2.7.6-8ubuntu0.6+esm14","2.7.6-8ubuntu0.6+esm15","2.7.6-8ubuntu0.6+esm16","2.7.6-8ubuntu0.6+esm17","2.7.6-8ubuntu0.6+esm18","2.7.6-8ubuntu0.6+esm20","2.7.6-8ubuntu0.6+esm21","2.7.6-8ubuntu0.6+esm22","2.7.6-8ubuntu0.6+esm24","2.7.6-8ubuntu0.6+esm25","2.7.6-8ubuntu0.6+esm26","2.7.6-8ubuntu0.6+esm28","2.7.6-8ubuntu0.6+esm29","2.7.6-8ubuntu0.6+esm30"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python3.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4~b1-0ubuntu3","3.4~b1-4ubuntu4","3.4~b1-4ubuntu6","3.4~b1-5ubuntu2","3.4~b2-1","3.4~b3-1ubuntu1","3.4~rc1-1build1","3.4~rc2-1","3.4~rc3-0ubuntu1","3.4.0-1","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.3-1ubuntu1~14.04.1","3.4.3-1ubuntu1~14.04.3","3.4.3-1ubuntu1~14.04.4","3.4.3-1ubuntu1~14.04.5","3.4.3-1ubuntu1~14.04.6","3.4.3-1ubuntu1~14.04.7","3.4.3-1ubuntu1~14.04.7+esm2","3.4.3-1ubuntu1~14.04.7+esm4","3.4.3-1ubuntu1~14.04.7+esm6","3.4.3-1ubuntu1~14.04.7+esm7","3.4.3-1ubuntu1~14.04.7+esm8","3.4.3-1ubuntu1~14.04.7+esm10","3.4.3-1ubuntu1~14.04.7+esm11","3.4.3-1ubuntu1~14.04.7+esm12","3.4.3-1ubuntu1~14.04.7+esm13","3.4.3-1ubuntu1~14.04.7+esm14","3.4.3-1ubuntu1~14.04.7+esm15","3.4.3-1ubuntu1~14.04.7+esm16","3.4.3-1ubuntu1~14.04.7+esm17","3.4.3-1ubuntu1~14.04.7+esm19","3.4.3-1ubuntu1~14.04.7+esm20","3.4.3-1ubuntu1~14.04.7+esm21"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python3.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2-2ubuntu0~16.04.4~14.04.1","3.5.2-2ubuntu0~16.04.4~14.04.1+esm1","3.5.2-2ubuntu0~16.04.4~14.04.1+esm3","3.5.2-2ubuntu0~16.04.4~14.04.1+esm4","3.5.2-2ubuntu0~16.04.4~14.04.1+esm5","3.5.2-2ubuntu0~16.04.4~14.04.1+esm6","3.5.2-2ubuntu0~16.04.4~14.04.1+esm7","3.5.2-2ubuntu0~16.04.4~14.04.1+esm8","3.5.2-2ubuntu0~16.04.4~14.04.1+esm9","3.5.2-2ubuntu0~16.04.4~14.04.1+esm10","3.5.2-2ubuntu0~16.04.4~14.04.1+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.10-4ubuntu1","2.7.10-4ubuntu2","2.7.11-2","2.7.11-3","2.7.11-4","2.7.11-6","2.7.11-7","2.7.11-7ubuntu1","2.7.12-1~16.04","2.7.12-1ubuntu0~16.04.1","2.7.12-1ubuntu0~16.04.2","2.7.12-1ubuntu0~16.04.3","2.7.12-1ubuntu0~16.04.4","2.7.12-1ubuntu0~16.04.8","2.7.12-1ubuntu0~16.04.9","2.7.12-1ubuntu0~16.04.11","2.7.12-1ubuntu0~16.04.12","2.7.12-1ubuntu0~16.04.13","2.7.12-1ubuntu0~16.04.14","2.7.12-1ubuntu0~16.04.16","2.7.12-1ubuntu0~16.04.18","2.7.12-1ubuntu0~16.04.18+esm1","2.7.12-1ubuntu0~16.04.18+esm2","2.7.12-1ubuntu0~16.04.18+esm3","2.7.12-1ubuntu0~16.04.18+esm4","2.7.12-1ubuntu0~16.04.18+esm5","2.7.12-1ubuntu0~16.04.18+esm6","2.7.12-1ubuntu0~16.04.18+esm7","2.7.12-1ubuntu0~16.04.18+esm8","2.7.12-1ubuntu0~16.04.18+esm9","2.7.12-1ubuntu0~16.04.18+esm10","2.7.12-1ubuntu0~16.04.18+esm11","2.7.12-1ubuntu0~16.04.18+esm12","2.7.12-1ubuntu0~16.04.18+esm13","2.7.12-1ubuntu0~16.04.18+esm15","2.7.12-1ubuntu0~16.04.18+esm16","2.7.12-1ubuntu0~16.04.18+esm17","2.7.12-1ubuntu0~16.04.18+esm18","2.7.12-1ubuntu0~16.04.18+esm19","2.7.12-1ubuntu0~16.04.18+esm20","2.7.12-1ubuntu0~16.04.18+esm21","2.7.12-1ubuntu0~16.04.18+esm22"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python3.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.0-3","3.5.0-3ubuntu1","3.5.1~rc1-2ubuntu1","3.5.1-1","3.5.1-2","3.5.1-3","3.5.1-5","3.5.1-6ubuntu1","3.5.1-6ubuntu2","3.5.1-9ubuntu1","3.5.1-10","3.5.2-2~16.01","3.5.2-2~16.04","3.5.2-2ubuntu0~16.04.1","3.5.2-2ubuntu0~16.04.2","3.5.2-2ubuntu0~16.04.3","3.5.2-2ubuntu0~16.04.4","3.5.2-2ubuntu0~16.04.5","3.5.2-2ubuntu0~16.04.8","3.5.2-2ubuntu0~16.04.9","3.5.2-2ubuntu0~16.04.10","3.5.2-2ubuntu0~16.04.11","3.5.2-2ubuntu0~16.04.12","3.5.2-2ubuntu0~16.04.13","3.5.2-2ubuntu0~16.04.13+esm1","3.5.2-2ubuntu0~16.04.13+esm2","3.5.2-2ubuntu0~16.04.13+esm3","3.5.2-2ubuntu0~16.04.13+esm5","3.5.2-2ubuntu0~16.04.13+esm6","3.5.2-2ubuntu0~16.04.13+esm7","3.5.2-2ubuntu0~16.04.13+esm8","3.5.2-2ubuntu0~16.04.13+esm9","3.5.2-2ubuntu0~16.04.13+esm10","3.5.2-2ubuntu0~16.04.13+esm11","3.5.2-2ubuntu0~16.04.13+esm12","3.5.2-2ubuntu0~16.04.13+esm13","3.5.2-2ubuntu0~16.04.13+esm14","3.5.2-2ubuntu0~16.04.13+esm15","3.5.2-2ubuntu0~16.04.13+esm16","3.5.2-2ubuntu0~16.04.13+esm17","3.5.2-2ubuntu0~16.04.13+esm18","3.5.2-2ubuntu0~16.04.13+esm19","3.5.2-2ubuntu0~16.04.13+esm20","3.5.2-2ubuntu0~16.04.13+esm21","3.5.2-2ubuntu0~16.04.13+esm22","3.5.2-2ubuntu0~16.04.13+esm23","3.5.2-2ubuntu0~16.04.13+esm24","3.5.2-2ubuntu0~16.04.13+esm25"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.14-2ubuntu2","2.7.14-4","2.7.14-6","2.7.14-7","2.7.14-8","2.7.15~rc1-1","2.7.15~rc1-1ubuntu0.1","2.7.15-4ubuntu4~18.04","2.7.15-4ubuntu4~18.04.1","2.7.15-4ubuntu4~18.04.2","2.7.17-1~18.04","2.7.17-1~18.04ubuntu1","2.7.17-1~18.04ubuntu1.1","2.7.17-1~18.04ubuntu1.2","2.7.17-1~18.04ubuntu1.3","2.7.17-1~18.04ubuntu1.5","2.7.17-1~18.04ubuntu1.6","2.7.17-1~18.04ubuntu1.7","2.7.17-1~18.04ubuntu1.8","2.7.17-1~18.04ubuntu1.10","2.7.17-1~18.04ubuntu1.11","2.7.17-1~18.04ubuntu1.13","2.7.17-1~18.04ubuntu1.13+esm1","2.7.17-1~18.04ubuntu1.13+esm2","2.7.17-1~18.04ubuntu1.13+esm3","2.7.17-1~18.04ubuntu1.13+esm4","2.7.17-1~18.04ubuntu1.13+esm5","2.7.17-1~18.04ubuntu1.13+esm6","2.7.17-1~18.04ubuntu1.13+esm7","2.7.17-1~18.04ubuntu1.13+esm8","2.7.17-1~18.04ubuntu1.13+esm10","2.7.17-1~18.04ubuntu1.13+esm11","2.7.17-1~18.04ubuntu1.13+esm12","2.7.17-1~18.04ubuntu1.13+esm13","2.7.17-1~18.04ubuntu1.13+esm14","2.7.17-1~18.04ubuntu1.13+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python3.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.3-1ubuntu1","3.6.4~rc1-1","3.6.4~rc1-2","3.6.4-1","3.6.4-2","3.6.4-3build1","3.6.4-4","3.6.5~rc1-1","3.6.5-3","3.6.6-1~18.04","3.6.7-1~18.04","3.6.8-1~18.04.1","3.6.8-1~18.04.2","3.6.8-1~18.04.3","3.6.9-1~18.04","3.6.9-1~18.04ubuntu1","3.6.9-1~18.04ubuntu1.1","3.6.9-1~18.04ubuntu1.3","3.6.9-1~18.04ubuntu1.4","3.6.9-1~18.04ubuntu1.6","3.6.9-1~18.04ubuntu1.7","3.6.9-1~18.04ubuntu1.8","3.6.9-1~18.04ubuntu1.9","3.6.9-1~18.04ubuntu1.10","3.6.9-1~18.04ubuntu1.12","3.6.9-1~18.04ubuntu1.13","3.6.9-1~18.04ubuntu1.13+esm1","3.6.9-1~18.04ubuntu1.13+esm2","3.6.9-1~18.04ubuntu1.13+esm3","3.6.9-1~18.04ubuntu1.13+esm4","3.6.9-1~18.04ubuntu1.13+esm5","3.6.9-1~18.04ubuntu1.13+esm6","3.6.9-1~18.04ubuntu1.13+esm7","3.6.9-1~18.04ubuntu1.13+esm8","3.6.9-1~18.04ubuntu1.13+esm9","3.6.9-1~18.04ubuntu1.13+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python3.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.0~a2-1","3.7.0~a3-1","3.7.0~a3-2","3.7.0~a3-3","3.7.0~a4-1","3.7.0~b1-1","3.7.0~b1-1build1","3.7.0~b2-1","3.7.0~b3-1","3.7.0-1~18.04","3.7.1-1~18.04","3.7.3-2~18.04.1","3.7.5-2~18.04","3.7.5-2~18.04.4","3.7.5-2ubuntu1~18.04.2","3.7.5-2ubuntu1~18.04.2+esm1","3.7.5-2ubuntu1~18.04.2+esm2","3.7.5-2ubuntu1~18.04.2+esm3","3.7.5-2ubuntu1~18.04.2+esm4","3.7.5-2ubuntu1~18.04.2+esm5","3.7.5-2ubuntu1~18.04.2+esm6","3.7.5-2ubuntu1~18.04.2+esm7","3.7.5-2ubuntu1~18.04.2+esm8","3.7.5-2ubuntu1~18.04.2+esm9","3.7.5-2ubuntu1~18.04.2+esm10","3.7.5-2ubuntu1~18.04.2+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python3.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-3~18.04","3.8.0-3~18.04.1","3.8.0-3ubuntu1~18.04.2","3.8.0-3ubuntu1~18.04.2+esm1","3.8.0-3ubuntu1~18.04.2+esm2","3.8.0-3ubuntu1~18.04.2+esm3","3.8.0-3ubuntu1~18.04.2+esm4","3.8.0-3ubuntu1~18.04.2+esm5","3.8.0-3ubuntu1~18.04.2+esm6","3.8.0-3ubuntu1~18.04.2+esm7","3.8.0-3ubuntu1~18.04.2+esm8","3.8.0-3ubuntu1~18.04.2+esm9","3.8.0-3ubuntu1~18.04.2+esm10","3.8.0-3ubuntu1~18.04.2+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python3.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-1","3.8.0-2","3.8.0-3","3.8.0-4","3.8.0-5","3.8.1-2ubuntu3","3.8.2~rc1-1ubuntu1","3.8.2-1","3.8.2-1ubuntu1","3.8.2-1ubuntu1.1","3.8.2-1ubuntu1.2","3.8.5-1~20.04","3.8.5-1~20.04.2","3.8.5-1~20.04.3","3.8.10-0ubuntu1~20.04","3.8.10-0ubuntu1~20.04.1","3.8.10-0ubuntu1~20.04.2","3.8.10-0ubuntu1~20.04.4","3.8.10-0ubuntu1~20.04.5","3.8.10-0ubuntu1~20.04.6","3.8.10-0ubuntu1~20.04.7","3.8.10-0ubuntu1~20.04.8","3.8.10-0ubuntu1~20.04.9","3.8.10-0ubuntu1~20.04.10","3.8.10-0ubuntu1~20.04.11","3.8.10-0ubuntu1~20.04.12","3.8.10-0ubuntu1~20.04.13","3.8.10-0ubuntu1~20.04.14","3.8.10-0ubuntu1~20.04.15","3.8.10-0ubuntu1~20.04.16","3.8.10-0ubuntu1~20.04.17","3.8.10-0ubuntu1~20.04.18","3.8.10-0ubuntu1~20.04.18+esm1","3.8.10-0ubuntu1~20.04.18+esm2","3.8.10-0ubuntu1~20.04.18+esm3","3.8.10-0ubuntu1~20.04.18+esm4","3.8.10-0ubuntu1~20.04.18+esm5","3.8.10-0ubuntu1~20.04.18+esm6","3.8.10-0ubuntu1~20.04.18+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.17~rc1-1","2.7.17-1","2.7.17-1ubuntu5","2.7.17-1ubuntu6","2.7.18~rc1-2","2.7.18-1~20.04","2.7.18-1~20.04.1","2.7.18-1~20.04.1+esm1","2.7.18-1~20.04.3","2.7.18-1~20.04.3+esm1","2.7.18-1~20.04.4","2.7.18-1~20.04.4+esm1","2.7.18-1~20.04.4+esm2","2.7.18-1~20.04.4+esm3","2.7.18-1~20.04.5","2.7.18-1~20.04.5+esm1","2.7.18-1~20.04.5+esm2","2.7.18-1~20.04.6","2.7.18-1~20.04.6+esm1","2.7.18-1~20.04.7","2.7.18-1~20.04.7+esm3","2.7.18-1~20.04.7+esm4","2.7.18-1~20.04.7+esm6","2.7.18-1~20.04.7+esm7","2.7.18-1~20.04.7+esm8","2.7.18-1~20.04.7+esm9","2.7.18-1~20.04.7+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python3.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.0~rc1-1~20.04","3.9.0-5~20.04","3.9.5-3~20.04.1","3.9.5-3ubuntu0~20.04.1","3.9.5-3ubuntu0~20.04.1+esm1","3.9.5-3ubuntu0~20.04.1+esm2","3.9.5-3ubuntu0~20.04.1+esm3","3.9.5-3ubuntu0~20.04.1+esm4","3.9.5-3ubuntu0~20.04.1+esm5","3.9.5-3ubuntu0~20.04.1+esm6","3.9.5-3ubuntu0~20.04.1+esm7","3.9.5-3ubuntu0~20.04.1+esm8","3.9.5-3ubuntu0~20.04.1+esm9","3.9.5-3ubuntu0~20.04.1+esm10","3.9.5-3ubuntu0~20.04.1+esm11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python3.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.0-2","3.10.0-3","3.10.0-4","3.10.0-5","3.10.0-5build1","3.10.1-1","3.10.1-2","3.10.2-1","3.10.2-5","3.10.2-7","3.10.3-1","3.10.4-3","3.10.4-3ubuntu0.1","3.10.6-1~22.04","3.10.6-1~22.04.1","3.10.6-1~22.04.2","3.10.6-1~22.04.2ubuntu1","3.10.6-1~22.04.2ubuntu1.1","3.10.12-1~22.04.2","3.10.12-1~22.04.3","3.10.12-1~22.04.4","3.10.12-1~22.04.5","3.10.12-1~22.04.6","3.10.12-1~22.04.7","3.10.12-1~22.04.8","3.10.12-1~22.04.9","3.10.12-1~22.04.10","3.10.12-1~22.04.11","3.10.12-1~22.04.12","3.10.12-1~22.04.13","3.10.12-1~22.04.14","3.10.12-1~22.04.15","3.10.12-1~22.04.16","3.10.12-1~22.04.17","3.10.12-1~22.04.18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.18-8build1","2.7.18-13","2.7.18-13ubuntu1","2.7.18-13ubuntu1.1","2.7.18-13ubuntu1.1+esm2","2.7.18-13ubuntu1.2","2.7.18-13ubuntu1.2+esm1","2.7.18-13ubuntu1.2+esm2","2.7.18-13ubuntu1.2+esm3","2.7.18-13ubuntu1.3","2.7.18-13ubuntu1.3+esm1","2.7.18-13ubuntu1.4","2.7.18-13ubuntu1.4+esm1","2.7.18-13ubuntu1.5","2.7.18-13ubuntu1.5+esm2","2.7.18-13ubuntu1.5+esm3","2.7.18-13ubuntu1.5+esm5","2.7.18-13ubuntu1.5+esm6","2.7.18-13ubuntu1.5+esm7","2.7.18-13ubuntu1.5+esm8","2.7.18-13ubuntu1.5+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python3.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.0~rc1-1~22.04","3.11.0~rc1-1~22.04.1~esm1","3.11.0~rc1-1~22.04.1~esm2","3.11.0~rc1-1~22.04.1~esm3","3.11.0~rc1-1~22.04.1~esm4","3.11.0~rc1-1~22.04.1~esm5","3.11.0~rc1-1~22.04.1~esm6","3.11.0~rc1-1~22.04.1~esm7","3.11.0~rc1-1~22.04.1~esm8","3.11.0~rc1-1~22.04.1~esm9","3.11.0~rc1-1~22.04.1","3.11.0~rc1-1~22.04.1+esm1","3.11.0~rc1-1~22.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python3.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.0-1","3.12.0-5","3.12.0-6","3.12.0-7","3.12.1-2","3.12.2-1","3.12.2-4build3","3.12.2-4build4","3.12.2-5ubuntu3","3.12.3-1","3.12.3-1ubuntu0.1","3.12.3-1ubuntu0.2","3.12.3-1ubuntu0.3","3.12.3-1ubuntu0.4","3.12.3-1ubuntu0.5","3.12.3-1ubuntu0.6","3.12.3-1ubuntu0.7","3.12.3-1ubuntu0.8","3.12.3-1ubuntu0.9","3.12.3-1ubuntu0.10","3.12.3-1ubuntu0.11","3.12.3-1ubuntu0.12","3.12.3-1ubuntu0.13","3.12.3-1ubuntu0.15","3.12.3-1ubuntu0.16","3.12.3-1ubuntu0.17"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.4-1","3.14.6-1","3.14.7-1ubuntu1","3.14.7-4ubuntu1","3.14.7-4ubuntu2","3.14.7-5ubuntu1","3.14.8-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0-1","3.14.0-2","3.14.0-4","3.14.2-1","3.14.3-1","3.14.3-2","3.14.3-3","3.14.3-5","3.14.4-1","3.14.4-1ubuntu0.1","3.14.4-1ubuntu0.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python315","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0~rc2-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python314","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.21-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python313","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.15-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python312","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-2.1"}]}],"bundled":4}],"products":[{"vendor":"python software foundation","product":"cpython"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ac0)"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp (6ag1518-4ax00-4ac0)"}],"references":[{"url":"https://github.com/python/cpython/pull/156003","tags":["patch","web","fix","article","report"]},{"url":"https://github.com/python/cpython/issues/156002","tags":["issue-tracking","web","report","article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","tags":["vendor-advisory","web","advisory","article","report"]},{"url":"https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","tags":["patch","web","fix","report"]},{"url":"https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","tags":["patch","web","fix"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","tags":["web","advisory"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK"},{"url":"https://github.com/advisories/GHSA-xj79-6hh5-9w6q"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-15310","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-15310","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789735614.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9669","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789993238.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1789995979.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1790007232.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791377791.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15310.json","tags":["advisory"]},{"url":"https://github.com/python/cpython","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-15310","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3755","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3756","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3757","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3920","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65505","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15310","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15806","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-17084","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19672","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82049","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65505.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523543","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15310","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/155694","tags":["article"]},{"url":"https://github.com/python/cpython/pull/155696","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517897","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/155292","tags":["article"]},{"url":"https://github.com/python/cpython/pull/155293","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519726","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","tags":["advisory"]},{"url":"https://github.com/python/cpython/pull/156000","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82049","tags":["advisory"]},{"url":"https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","tags":["article"]},{"url":"https://github.com/python/cpython/issues/157190","tags":["article"]},{"url":"https://github.com/python/cpython/pull/157191","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65513","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65513.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65525","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65525.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65531","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65531.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65567","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65567.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624138-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276227","tags":["report"]},{"url":"https://bugzilla.suse.com/1277111","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19672","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624280-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276223","tags":["report"]},{"url":"https://bugzilla.suse.com/1276226","tags":["report"]},{"url":"https://bugzilla.suse.com/1280459","tags":["report"]},{"url":"https://bugzilla.suse.com/1283826","tags":["report"]},{"url":"https://bugzilla.suse.com/1283969","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82049","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624325-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264396-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267974","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9669","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264534-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259240","tags":["report"]},{"url":"https://bugzilla.suse.com/1259611","tags":["report"]},{"url":"https://bugzilla.suse.com/1259735","tags":["report"]},{"url":"https://bugzilla.suse.com/1260026","tags":["report"]},{"url":"https://bugzilla.suse.com/1261969","tags":["report"]},{"url":"https://bugzilla.suse.com/1262098","tags":["report"]},{"url":"https://bugzilla.suse.com/1264962","tags":["report"]},{"url":"https://bugzilla.suse.com/1265268","tags":["report"]},{"url":"https://bugzilla.suse.com/1267581","tags":["report"]},{"url":"https://bugzilla.suse.com/1267821","tags":["report"]},{"url":"https://bugzilla.suse.com/1268977","tags":["report"]},{"url":"https://bugzilla.suse.com/1269066","tags":["report"]},{"url":"https://bugzilla.suse.com/1269788","tags":["report"]},{"url":"https://bugzilla.suse.com/1269959","tags":["report"]},{"url":"https://bugzilla.suse.com/1271192","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8328","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264630-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264743-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259989","tags":["report"]},{"url":"https://bugzilla.suse.com/1261970","tags":["report"]},{"url":"https://bugzilla.suse.com/1262429","tags":["report"]},{"url":"https://bugzilla.suse.com/1273091","tags":["report"]},{"url":"https://bugzilla.suse.com/1273148","tags":["report"]},{"url":"https://bugzilla.suse.com/1274683","tags":["report"]},{"url":"https://bugzilla.suse.com/1274743","tags":["report"]},{"url":"https://bugzilla.suse.com/1276903","tags":["report"]},{"url":"https://bugzilla.suse.com/1277271","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6879","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264744-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4435","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264754-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257599","tags":["report"]},{"url":"https://bugzilla.suse.com/1262467","tags":["report"]},{"url":"https://bugzilla.suse.com/1263083","tags":["report"]},{"url":"https://bugzilla.suse.com/1263443","tags":["report"]},{"url":"https://bugzilla.suse.com/1266669","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8643","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264809-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264941-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1285433","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264946-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-15310","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-15310","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-08-25T15:07:58.054Z","modified":"2026-11-10T12:40:48.945Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-10T13:38:44.039016Z"}],"euvd":[{"id":"EUVD-2026-65519","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-08-25T15:07:58Z","modified":"2026-11-10T12:40:48Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-10T14:21:11.690542Z"}],"ghsa":[{"id":"GHSA-xj79-6hh5-9w6q","title":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could...","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-08-25T15:33:00Z","modified":"2026-11-10T15:33:59Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-400"],"updated_at":"2026-11-10T15:55:02.881893Z"}],"nvd":[{"id":"CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-08-25T15:16:30.027Z","modified":"2026-11-10T13:18:27.24Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-10T16:19:48.101992Z"}],"osv":[{"id":"ALPINE-CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-08-25T15:16:30.027Z","modified":"2026-10-01T15:30:03.574545016Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2026-15310","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-08-25T15:07:58.054Z","modified":"2026-11-04T02:47:32.049479296Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-400"],"updated_at":"2026-11-04T02:53:45.692342Z"},{"id":"DEBIAN-CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard   compressions, Python could use an attacker-controlled size to   pre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-08-25T15:16:30.027Z","modified":"2026-11-01T17:00:13.206782765Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"OESA-2026-3755","title":"python3 security update","description":"Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.\r\n\r\nSecurity Fix(es):\n\nWhen decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.(CVE-2026-15310)","status":"published","published":"2026-09-14T16:34:01Z","modified":"2026-09-13T16:45:32.436842297Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3756","title":"python3 security update","description":"Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.\r\n\r\nSecurity Fix(es):\n\nWhen decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.(CVE-2026-15310)","status":"published","published":"2026-09-14T16:34:02Z","modified":"2026-09-13T16:45:32.434197576Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3757","title":"python3 security update","description":"Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.\r\n\r\nSecurity Fix(es):\n\nWhen decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.(CVE-2026-15310)","status":"published","published":"2026-09-14T16:34:03Z","modified":"2026-09-13T16:45:32.432724146Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3920","title":"python3 security update","description":"Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.\r\n\r\nSecurity Fix(es):\n\nWhen decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.(CVE-2026-15310)","status":"published","published":"2026-09-20T13:23:14Z","modified":"2026-09-20T13:30:24.702945009Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:65505","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-09T10:20:31Z","modified":"2026-10-17T10:42:51.594643905Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:65513","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-09T10:20:32Z","modified":"2026-10-17T10:42:49.981444227Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:65525","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-09T10:20:34Z","modified":"2026-10-17T10:42:52.640429147Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:65531","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-09T10:20:35Z","modified":"2026-10-17T10:42:51.730691262Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:65567","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-09T10:20:36Z","modified":"2026-10-17T10:42:50.901714148Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-08-25T15:16:00Z","modified":"2026-10-17T12:59:52.984173298Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"AZL-98208","title":"CVE-2026-15310 affecting package python3 for versions less than 3.12.15-1","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-08-25T15:16:30Z","modified":"2026-11-02T14:18:08.600546208Z","updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"AZL-98217","title":"CVE-2026-15310 affecting package tensorflow 2.16.1-11","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-08-25T15:16:30Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"BELL-CVE-2026-15310","status":"published","published":"2026-09-03T06:05:20.807465Z","modified":"2026-09-06T07:15:22.835787755Z","updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"BIT-libpython-2026-15310","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-09-11T05:48:20.534Z","modified":"2026-10-05T14:30:04.553573601Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-python-2026-15310","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-09-11T05:56:22.537Z","modified":"2026-10-05T14:30:06.376093848Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"BIT-python-min-2026-15310","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-09-11T05:56:22.303Z","modified":"2026-10-05T14:30:05.523655061Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"CLSA-2026-1789735614","title":"python3.11: Fix of 5 CVEs","description":"- CVE-2026-87910: tarfile: skip a link member when the extraction filter\n  returns None for its hardlink-extraction fallback instead of ignoring the\n  filter result\n- CVE-2026-17084: stringprep: build the RFC 3454 B.2/B.3 tables from Unicode\n  3.2.0 data so IDNA 2003 encoding of newly case-folding characters no longer\n  depends on the interpreter's Unicode version\n- CVE-2026-15310: zipfile: bound the output of each bzip2/LZMA decompress()\n  call so a small crafted member cannot trigger an unbounded allocation\n- CVE-2026-9669: bz2: refuse to reuse a BZ2Decompressor after a decompression\n  error, so retrying with the same object can no longer resume from an invalid\n  internal state and write out of bounds\n- CVE-2026-11972: tarfile: stop the streaming-mode seek() loop at EOF so a\n  member header declaring a huge size no longer makes parsing take exponentially\n  longer","status":"published","published":"2026-09-18T12:47:09Z","modified":"2026-10-26T09:43:37.758888416Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1789993238","title":"python3.9: Fix of 4 CVEs","description":"- CVE-2026-87910: tarfile: skip a link member when the extraction filter\n  returns None for its hardlink-extraction fallback instead of ignoring the\n  filter result\n- CVE-2026-17084: stringprep: build the RFC 3454 B.2/B.3 tables from Unicode\n  3.2.0 data so IDNA 2003 encoding of newly case-folding characters no longer\n  depends on the interpreter's Unicode version\n- CVE-2026-15310: zipfile: bound the output of each bzip2/LZMA decompress()\n  call so a small crafted member cannot trigger an unbounded allocation\n- CVE-2026-9669: bz2: refuse to reuse a BZ2Decompressor after a decompression\n  error, so retrying with the same object can no longer resume from an invalid\n  internal state and write out of bounds","status":"published","published":"2026-09-21T12:20:52Z","modified":"2026-10-26T09:43:29.599797391Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1789995979","title":"python3: Fix of 4 CVEs","description":"- CVE-2026-87910: tarfile: skip a link member when the extraction filter\n  returns None for its hardlink-extraction fallback instead of ignoring the\n  filter result\n- CVE-2026-17084: stringprep: build the RFC 3454 B.2/B.3 tables from Unicode\n  3.2.0 data so IDNA 2003 encoding of newly case-folding characters no longer\n  depends on the interpreter's Unicode version\n- CVE-2026-15310: zipfile: bound the output of each bzip2/LZMA decompress()\n  call so a small crafted member cannot trigger an unbounded allocation\n- CVE-2026-9669: bz2: refuse to reuse a BZ2Decompressor after a decompression\n  error, so retrying with the same object can no longer resume from an invalid\n  internal state and write out of bounds","status":"published","published":"2026-09-21T13:06:33Z","modified":"2026-10-26T09:43:32.352953053Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790007232","title":"python3: Fix of 4 CVEs","description":"- CVE-2026-87910: tarfile: skip a link member when the extraction filter\n  returns None for its hardlink-extraction fallback instead of ignoring the\n  filter result\n- CVE-2026-17084: stringprep: build the RFC 3454 B.2/B.3 tables from Unicode\n  3.2.0 data so IDNA 2003 encoding of newly case-folding characters no longer\n  depends on the interpreter's Unicode version\n- CVE-2026-15310: zipfile: bound the output of each bzip2/LZMA decompress()\n  call so a small crafted member cannot trigger an unbounded allocation\n- CVE-2026-9669: bz2: refuse to reuse a BZ2Decompressor after a decompression\n  error, so retrying with the same object can no longer resume from an invalid\n  internal state and write out of bounds","status":"published","published":"2026-09-21T16:14:04Z","modified":"2026-10-26T09:43:41.12001764Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1791377791","title":"python3.11: Fix of CVE-2026-15310","description":"- CVE-2026-15310: zipfile: bound the output of each bzip2/LZMA decompress()\n  call so a small crafted member cannot trigger an unbounded allocation","status":"published","published":"2026-10-07T12:56:43Z","modified":"2026-10-26T09:30:53.258724714Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"openSUSE-SU-2026:11748-1","title":"python315-3.15.0~rc2-1.1 on GA media","description":"These are all security issues fixed in the python315-3.15.0~rc2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-10T00:00:00Z","modified":"2026-09-11T18:23:08.956430992Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11868-1","title":"python314-3.14.7-2.1 on GA media","description":"These are all security issues fixed in the python314-3.14.7-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-09-24T18:23:15.43983417Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11886-1","title":"python311-3.11.16-2.1 on GA media","description":"These are all security issues fixed in the python311-3.11.16-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-25T18:23:09.680980561Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11949-1","title":"python310-3.10.21-2.1 on GA media","description":"These are all security issues fixed in the python310-3.10.21-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-01T00:00:00Z","modified":"2026-10-02T18:23:13.12082247Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11950-1","title":"python313-3.13.15-2.1 on GA media","description":"These are all security issues fixed in the python313-3.13.15-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-01T00:00:00Z","modified":"2026-10-02T18:23:13.123548336Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11975-1","title":"python312-3.12.14-2.1 on GA media","description":"These are all security issues fixed in the python312-3.12.14-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:10.332869907Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PSF-2026-39","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion.","status":"published","published":"2026-08-25T15:07:58.054Z","modified":"2026-10-01T03:45:05.830872305Z","updated_at":"2026-11-02T15:52:50.667197Z"},{"id":"SUSE-SU-2026:24138-1","title":"Security update for python311","description":"This update for python311 fixes the following issues:\n\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n","status":"published","published":"2026-10-10T17:21:34Z","modified":"2026-10-15T17:23:12.029117465Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24280-1","title":"Security update for python311","description":"This update for python311 fixes the following issues:\n\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python311:\n\n- Update to 3.11.17:\n - Security\n - gh-158446: Fix a crash or incorrect output that could occur\n when formatting a float or complex with a precision close\n to the platform's INT_MAX. PyOS_double_to_string() now\n raises ValueError for any precision of that magnitude,\n regardless of presentation type or value, as the format\n string parsers already did for precisions above INT_MAX.\n - gh-157190: Fixed a vulnerability in the tarfile data and\n tar extraction filters where a crafted archive using a hard\n link to a symbolic link could change the permissions and\n modification time of a file outside the destination\n directory, and expose its contents inside the extracted\n tree. This addresses CVE 2026-82049. (bsc#1280459,\n CVE-2026-82049)\n - gh-156793: asyncio: loop.start_tls() and\n loop.create_connection() now validate the server_hostname\n argument if an ssl.SSLContext is passed with check_hostname\n set to True, emitting DeprecationWarning if server_hostname\n is missing. (This will raise ValueError in Python 3.13 and\n later.) (bsc#1283826, CVE-2026-19553)\n - gh-156793: ssl.SSLContext.wrap_bio() now validates its\n server_side, server_hostname and session arguments similar\n to ssl.SSLContext.wrap_socket(), but for backward\n compatiblity reasons emits DeprecationWarning instead of\n ValueError.\n In particular, a context with check_hostname enabled and no\n server_hostname passed to wrap_bio() now emits\n DeprecationWarning to indicate the hostname wasn't\n checked. (In Python 3.13 and later, this raises\n ValueError.)\n - gh-157265: In tarfile, when extracting a link falls back to\n extracting a member of the archive, skip the member when\n the filter function returns None when called with the\n extracted member's name replaced with the link's.\n - gh-157953: Update bundled libexpat to version 2.8.5.\n - gh-156002: Bound the amount of data zipfile decompresses\n per read for members compressed with bzip2, LZMA, or\n Zstandard, matching the existing limit for deflate. A small\n archive member could previously expand into an unbounded\n allocation even when read in small chunks. (bsc#1277111,\n CVE-2026-15310)\n - gh-155999: Fix the tarfile tar and data extraction filters\n creating directories outside the destination for members\n whose name leaves the destination and returns to it, such\n as ../evil/../dest/sub/file. The containment check used the\n resolved path, but intermediate directories were created\n from the name as given. (bsc#1276227, CVE-2026-19672)\n - gh-156293: Fix a crash in ssl when an sni_callback switches\n a connection to another SSLContext and the context that\n carries the callback is no longer referenced by the\n application. Servers that keep their sni_callback context\n alive (the usual case when it wraps the listening socket or\n is stored on the server object) were not affected. This\n addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445)\n - gh-155292: Change the stringprep module and encodings.idna\n codec to not consider Unicode codepoint attributes beyond\n those defined in RFC 3454. (bsc#1276226, CVE-2026-17084)\n - gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr\n credentials to the URL scheme, preventing credentials\n stored for an HTTPS URL from being used for a matching HTTP\n URL, while URIs without a scheme continue to match any\n scheme. (bsc#1276223, CVE-2026-15806)\n - Library\n - gh-156002: zipfile again reads members through a\n third-party decompressor installed by monkey-patching the\n private _get_decompressor() to return an object that only\n implements old BZ2Decompressor API from Python 3.3. Note\n that decompressors without needs_input and two-argument\n decompress() are vulnerable to CVE 2026-15310.\n - gh-156353: Fix configparser parsing when using whitespace\n in delimiters.\n - Build\n - gh-155757: Set the --argv0 argument to wasmtime for WASI\n builds so the test suite passes. Otherwise the calculated\n paths to the stdlib for frozen modules is incorrect.\n- CVE-2026-15310: bound zipfile decompression for\n bzip2/LZMA (bsc#1277111, gh#python/cpython#156002)\n- CVE-2026-19672: in tarfile, handle a member that leaves the\n destination and comes back (bsc#1276227, gh#python/cpython#156000)\n","status":"published","published":"2026-10-19T10:15:52Z","modified":"2026-10-27T17:23:10.505232038Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24325-1","title":"Security update for python311","description":"This update for python311 fixes the following issues:\n\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python311:\n\n- Update to 3.11.17:\n - Security\n - gh-158446: Fix a crash or incorrect output that could occur\n when formatting a float or complex with a precision close\n to the platform's INT_MAX. PyOS_double_to_string() now\n raises ValueError for any precision of that magnitude,\n regardless of presentation type or value, as the format\n string parsers already did for precisions above INT_MAX.\n - gh-157190: Fixed a vulnerability in the tarfile data and\n tar extraction filters where a crafted archive using a hard\n link to a symbolic link could change the permissions and\n modification time of a file outside the destination\n directory, and expose its contents inside the extracted\n tree. This addresses CVE 2026-82049. (bsc#1280459,\n CVE-2026-82049)\n - gh-156793: asyncio: loop.start_tls() and\n loop.create_connection() now validate the server_hostname\n argument if an ssl.SSLContext is passed with check_hostname\n set to True, emitting DeprecationWarning if server_hostname\n is missing. (This will raise ValueError in Python 3.13 and\n later.) (bsc#1283826, CVE-2026-19553)\n - gh-156793: ssl.SSLContext.wrap_bio() now validates its\n server_side, server_hostname and session arguments similar\n to ssl.SSLContext.wrap_socket(), but for backward\n compatiblity reasons emits DeprecationWarning instead of\n ValueError.\n In particular, a context with check_hostname enabled and no\n server_hostname passed to wrap_bio() now emits\n DeprecationWarning to indicate the hostname wasn't\n checked. (In Python 3.13 and later, this raises\n ValueError.)\n - gh-157265: In tarfile, when extracting a link falls back to\n extracting a member of the archive, skip the member when\n the filter function returns None when called with the\n extracted member's name replaced with the link's.\n - gh-157953: Update bundled libexpat to version 2.8.5.\n - gh-156002: Bound the amount of data zipfile decompresses\n per read for members compressed with bzip2, LZMA, or\n Zstandard, matching the existing limit for deflate. A small\n archive member could previously expand into an unbounded\n allocation even when read in small chunks. (bsc#1277111,\n CVE-2026-15310)\n - gh-155999: Fix the tarfile tar and data extraction filters\n creating directories outside the destination for members\n whose name leaves the destination and returns to it, such\n as ../evil/../dest/sub/file. The containment check used the\n resolved path, but intermediate directories were created\n from the name as given. (bsc#1276227, CVE-2026-19672)\n - gh-156293: Fix a crash in ssl when an sni_callback switches\n a connection to another SSLContext and the context that\n carries the callback is no longer referenced by the\n application. Servers that keep their sni_callback context\n alive (the usual case when it wraps the listening socket or\n is stored on the server object) were not affected. This\n addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445)\n - gh-155292: Change the stringprep module and encodings.idna\n codec to not consider Unicode codepoint attributes beyond\n those defined in RFC 3454. (bsc#1276226, CVE-2026-17084)\n - gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr\n credentials to the URL scheme, preventing credentials\n stored for an HTTPS URL from being used for a matching HTTP\n URL, while URIs without a scheme continue to match any\n scheme. (bsc#1276223, CVE-2026-15806)\n - Library\n - gh-156002: zipfile again reads members through a\n third-party decompressor installed by monkey-patching the\n private _get_decompressor() to return an object that only\n implements old BZ2Decompressor API from Python 3.3. Note\n that decompressors without needs_input and two-argument\n decompress() are vulnerable to CVE 2026-15310.\n - gh-156353: Fix configparser parsing when using whitespace\n in delimiters.\n - Build\n - gh-155757: Set the --argv0 argument to wasmtime for WASI\n builds so the test suite passes. Otherwise the calculated\n paths to the stdlib for frozen modules is incorrect.\n","status":"published","published":"2026-10-19T08:33:46Z","modified":"2026-10-27T17:23:13.818442651Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4396-1","title":"Security update for python311","description":"This update for python311 fixes the following issues:\n\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another\n  scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for\n  members whose name leaves the destination and retu (bsc#1276227).\n\nChanges for python311:\n\n- Update to version 3.11.16.\n","status":"published","published":"2026-09-29T13:34:58Z","modified":"2026-09-30T12:00:05.050575008Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4534-1","title":"Security update for python312","description":"This update for python312 fixes the following issues:\n\n- CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).\n- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the\n  `configparser` module is used (bsc#1269066).\n- CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).\n- CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).\n- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted\n  Unicode input (bsc#1267581).\n- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).\n- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting\n  hardlinks (bsc#1269959).\n- CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web browser command\n  line option injection (bsc#1260026).\n- CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules\n  (bsc#1262098).\n- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding\n  protection (bsc#1264962).\n- CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory\n  (bsc#1267821).\n- CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and\n  enables arbitrary file reads and writes (bsc#1268977).\n- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS\n  (bsc#1269788).\n- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations\n  (bsc#1271192).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for\n  members whose name leaves the destination and retu (bsc#1276227).\n\nChanges for python312:\n\n- Update to 3.12.14:\n - Core and Builtins\n - gh-139808: Add branch protections for AArch64 (BTI/PAC) in\n assembly code used by -X perf_jit (Linux perf profiler\n integration).\n - Documentation\n - gh-136155: We are now checking for fatal errors in EPUB\n builds in CI.\n - Library\n - gh-109638: Fix exponential time in csv.Sniffer.sniff() for\n a sample which contains many quote characters. A doubled\n quote character is now also detected in a field which\n contains the delimiter or a line break.\n - gh-98820: Fix quadratic time in csv.Sniffer.sniff() for\n a sample which contains quoted fields, in particular for\n a single column of quoted fields.\n - gh-149231: In tomllib, the number of parts in TOML keys is\n now limited.\n - gh-146083: Update bundled libexpat to version 2.7.5.\n - gh-141707: Don't change tarfile.TarInfo type from AREGTYPE\n to DIRTYPE when parsing GNU long name or link headers\n (bsc#1259611, CVE-2025-13462).\n - gh-90949: Add\n SetBillionLaughsAttackProtectionActivationThreshold() and\n SetBillionLaughsAttackProtectionMaximumAmplification() to\n xmlparser objects to tune protections against billion\n laughs attacks. Patch by B�n�dikt Tran.\n - Security\n - gh-155558: Update bundled libexpat to version 2.8.3 for the\n fix to CVE 2026-72522.\n - gh-153030: Fixed quadratic complexity in incremental\n parsing of long unterminated constructs (such as tags or\n comments) in html.parser.HTMLParser, which could be\n exploited for a denial of service (bsc#1271192,\n CVE-2026-15308).\n - gh-152674: The xml.etree.ElementTree.Element methods\n findall(), iterfind() and find() avoid quadratic behavior\n when using XPath index predicates ([1], [last()],\n [last()-N]) on XML documents with many same-tag siblings.\n - gh-152216: Update bundled libexpat to version 2.8.2.\n - gh-151987: The tarfile.TarFile.extract() method now applies\n the given filter when it extracts a link target from the\n archive as a fallback (bsc#1269959, CVE-2026-4360).\n - gh-151981: In tarfile, seeking a stream now stops when end\n of the stream is reached (bsc#1269788, CVE-2026-11972).\n - gh-151544: Modules/Setup.local is no longer used as\n a landmark to discover whether Python is running in\n a source tree, as it could potentially affect actual\n installs. The pybuilddir.txt file is now the sole indicator\n of running in a source tree.\n - gh-151558: Fixed an vulnerability in the tarfile data and\n tar extraction filters where crafted archives could create\n a symlink pointing outside the destination directory. This\n was a bypass of CVE 2025-4330 (bsc#1268977,\n CVE-2026-11940).\n - gh-150599: Fix a possible stack buffer overflow in bz2 when\n a bz2.BZ2Decompressor is reused after a decompression\n error. The decompressor now becomes unusable after libbz2\n reports an error (bsc#1267974, CVE-2026-9669).\n - gh-150743: http.client now limits the number of\n chunked-response trailer lines it will read to 100, and the\n number of interim (1xx) responses it will skip to 100.\n A malicious or broken server could previously stream\n trailer lines or 100 Continue responses forever, hanging\n the client even when a socket timeout was in use. Reported\n by @YLChen-007 via GHSA-w4q2-g22w-6fr4.\n - gh-149698: Update bundled libexpat to version 2.8.1 for the\n fix for CVE 2026-45186.\n - gh-87451: The ftplib module's undocumented ftpcp function\n no longer trusts the IPv4 address value returned from the\n source server in response to the PASV command by default,\n completing the fix for CVE-2021-4189. As with ftplib.FTP,\n the former behavior can be re-enabled by setting the\n trust_server_pasv_ipv4_address attribute on the source\n ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape\n AI for the report (bsc#1265268, CVE-2026-8328).\n - gh-149486: tarfile.data_filter() now validates link targets\n using the same normalised value that is written to disk,\n strips trailing separators from the member name when\n resolving a symlink's directory, and rejects link members\n that would replace the destination directory itself. This\n closes several path-traversal bypasses of the data\n extraction filter (bsc#1267821, CVE-2026-7774).\n - gh-149079: Fix a potential denial of service in\n unicodedata.normalize(). The canonical ordering step of\n Unicode normalization used a quadratic-time insertion sort\n for reordering combining characters, which could be\n exploited with crafted input containing many combining\n characters in non-canonical order. Replaced with\n a linear-time counting sort for long runs (bsc#1267581,\n CVE-2026-3276).\n - gh-149018: Improved protection against XML hash-flooding\n attacks in xml.parsers.expat and xml.etree.ElementTree when\n Python is compiled with libExpat 2.8.0 or later\n (bsc#1264962, CVE-2026-7210).\n - gh-149017: Update bundled libexpat to version 2.8.0.\n - gh-148808: Added buffer boundary check when using nbytes\n parameter with\n asyncio.AbstractEventLoop.sock_recvfrom_into(). Only\n relevant for Windows and the asyncio.ProactorEventLoop.\n - gh-148395: Fix a dangling input pointer in\n lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal\n zlib._ZlibDecompressor when memory allocation fails with\n MemoryError, which could let a subsequent decompress() call\n read or write through a stale pointer to the\n already-released caller buffer (bsc#1262098, CVE-2026-6100,\n seems like it has been incompletely applied\n gh#python/cpython#151605).\n - gh-148169: A bypass in webbrowser allowed URLs prefixed\n with %action to pass the dash-prefix safety check\n (bsc#1262098, CVE-2026-6100).\n - gh-146581: Fix vulnerability in shutil.unpack_archive() for\n ZIP files on Windows which allowed to write files outside\n of the destination tree if the patch in the archive\n contains a Windows drive prefix. Now such invalid paths\n will be skipped. Files containing '..' in the name (like\n 'foo..bar') are no longer skipped.\n - gh-146333: Fix quadratic backtracking in\n configparser.RawConfigParser option parsing regexes (OPTCRE\n and OPTCRE_NV). A crafted configuration line with many\n whitespace characters could cause excessive CPU usage.\n - gh-146211: Reject CR/LF characters in tunnel request\n headers for the HTTPConnection.set_tunnel() method\n (bsc#1261969, CVE-2026-1502).\n - gh-145986: xml.parsers.expat: Fixed a crash caused by\n unbounded C recursion when converting deeply nested XML\n content models with ElementDeclHandler(). This addresses\n CVE 2026-4224 (bsc#1259735, CVE-2026-4224).\n - gh-145599: Reject control characters in http.cookies.Morsel\n update() and js_output(). This addresses CVE 2026-3644.\n - gh-145506: Fixes CVE 2026-2297 by ensuring that\n SourcelessFileLoader uses io.open_code() when opening .pyc\n files (bsc#1259240, CVE-2026-2297).\n - gh-144370: Disallow usage of control characters in status\n in wsgiref.handlers to prevent HTTP header injections.\n Patch by Benedikt Johannes.\n - gh-143930: Reject leading dashes in URLs passed to\n webbrowser.open() (bsc#1260026, CVE-2026-4519).\n - gh-143927: Normalize all line endings (CR, CRLF, and LF) to\n LF+TAB when writing multi-line configparser values\n (bsc#1269066, CVE-2026-0864).\n - Tests\n - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:\n skip UDP Lite tests if it's not supported. Patch by Victor\n Stinner.\n","status":"published","published":"2026-10-06T07:58:38Z","modified":"2026-10-06T18:45:06.179529142Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4630-1","title":"Security update for python310","description":"This update for python310 fixes the following issues:\n\n- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding\n  protection (bsc#1264962).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python310:\n\n- Update to 3.10.22 (final release, upstream EOS)\n - Security\n - gh-158446: Fix a crash or incorrect output that could occur\n when formatting a float or complex with a precision close\n to the platform's INT_MAX. PyOS_double_to_string() now\n raises ValueError for any precision of that magnitude,\n regardless of presentation type or value, as the format\n string parsers already did for precisions above INT_MAX.\n - gh-156793: asyncio: loop.start_tls() and\n loop.create_connection() now validate the server_hostname\n argument if an ssl.SSLContext is passed with check_hostname\n set to True, emitting DeprecationWarning if server_hostname\n is missing. (This will raise ValueError in Python 3.13 and\n later.) (bsc#1283826, CVE-2026-19553)\n - gh-156793: ssl.SSLContext.wrap_bio() now validates its\n server_side, server_hostname and session arguments similar\n to ssl.SSLContext.wrap_socket(), but for backward\n compatiblity reasons emits DeprecationWarning instead of\n ValueError.\n In particular, a context with check_hostname enabled and no\n server_hostname passed to wrap_bio() now emits\n DeprecationWarning to indicate the hostname wasn't\n checked. (In Python 3.13 and later, this raises\n ValueError.)\n - gh-157265: In tarfile, when extracting a link falls back to\n extracting a member of the archive, skip the member when\n the filter function returns None when called with the\n extracted member's name replaced with the link's.\n - gh-157190: Fixed a vulnerability in the tarfile data and\n tar extraction filters where a crafted archive using a hard\n link to a symbolic link could change the permissions and\n modification time of a file outside the destination\n directory, and expose its contents inside the extracted\n tree. This addresses CVE 2026-82049.(bsc#1280459,\n CVE-2026-82049)\n - gh-157953: Update bundled libexpat to version 2.8.5.\n - gh-156002: Bound the amount of data zipfile decompresses\n per read for members compressed with bzip2, LZMA, or\n Zstandard, matching the existing limit for deflate. A small\n archive member could previously expand into an unbounded\n allocation even when read in small chunks. (bsc#1277111,\n CVE-2026-15310)\n - gh-155999: Fix the tarfile tar and data extraction filters\n creating directories outside the destination for members\n whose name leaves the destination and returns to it, such\n as ../evil/../dest/sub/file. The containment check used the\n resolved path, but intermediate directories were created\n from the name as given. (bsc#1276227, CVE-2026-19672)\n - gh-156293: Fix a crash in ssl when an sni_callback switches\n a connection to another SSLContext and the context that\n carries the callback is no longer referenced by the\n application. Servers that keep their sni_callback context\n alive (the usual case when it wraps the listening socket or\n is stored on the server object) were not affected. This\n addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445)\n - gh-155292: Change the stringprep module and encodings.idna\n codec to not consider Unicode codepoint attributes beyond\n those defined in RFC 3454. (bsc#1276226, CVE-2026-17084)\n - gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr\n credentials to the URL scheme, preventing credentials\n stored for an HTTPS URL from being used for a matching HTTP\n URL, while URIs without a scheme continue to match any\n scheme. (bsc#1276223, CVE-2026-15806)\n - gh-149018: Improved protection against XML hash-flooding\n attacks in xml.parsers.expat and xml.etree.ElementTree when\n Python is compiled with libExpat 2.8.0 or later.\n (bsc#1264962, CVE-2026-7210)\n - Library\n - gh-156002: zipfile again reads members through a\n third-party decompressor installed by monkey-patching the\n private _get_decompressor() to return an object that only\n implements old BZ2Decompressor API from Python 3.3. Note\n that decompressors without needs_input and two-argument\n decompress() are vulnerable to CVE 2026-15310.\n - gh-156353: Fix configparser parsing when using whitespace\n in delimiters.\n","status":"published","published":"2026-10-12T15:25:09Z","modified":"2026-10-13T10:30:06.861807744Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4743-1","title":"Security update for python36","description":"This update for python36 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously\n  crafted wheel archives (bsc#1274743).\n- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).\n- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).\n- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).\n- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).\n- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high\n  CPU usage (bsc#1273148).\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect\n  sniffing and consume significant CPU (bsc#1274683).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nNon security issue fixed:\n\n- Update bundled setuptools wheels to\n setuptools-44.1.1-py2.py3-none-any.whl (bsc#1277271)\n","status":"published","published":"2026-10-19T15:00:47Z","modified":"2026-10-20T10:45:04.35999946Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4744-1","title":"Security update for python3, python3-base, python3-doc","description":"This update for python3, python3-base, python3-doc fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high\n  CPU usage (bsc#1273148).\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect\n  sniffing and consume significant CPU (bsc#1274683).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python3:\n\n- Update bundled setuptools wheels to setuptools-40.6.2 (bsc#1276903).\n","status":"published","published":"2026-10-19T15:01:31Z","modified":"2026-10-20T10:45:04.356081161Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4754-1","title":"Security update for python3","description":"This update for python3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the\n  `configparser` module is used (bsc#1269066).\n- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously\n  crafted wheel archives (bsc#1257599 bsc#1274743).\n- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429 bsc#1262467).\n- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted\n  Unicode input (bsc#1267581).\n- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).\n- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).\n- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).\n- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting\n  hardlinks (bsc#1269959).\n- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442\n  bsc#1263443).\n- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high\n  CPU usage (bsc#1273148).\n- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding\n  protection (bsc#1264962).\n- CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory\n  (bsc#1267821).\n- CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).\n- CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite\n  (bsc#1266669).\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and\n  enables arbitrary file reads and writes (bsc#1268977).\n- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS\n  (bsc#1269788).\n- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).\n- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations\n  (bsc#1271192).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect\n  sniffing and consume significant CPU (bsc#1274683).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nNon security issue fixed:\n\n- Fix an error that returned non-zero exit status 1 (bsc#1277271).\n- Fix regression in `http.cookies` (bsc#1263083).  \n- Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl.\n","status":"published","published":"2026-10-20T10:52:18Z","modified":"2026-10-21T13:00:04.220561742Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4809-1","title":"Security update for python311","description":"This update for python311 fixes the following issues:\n\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python311:\n\n- Update to 3.11.17:\n - Library\n - gh-156002: zipfile again reads members through a\n third-party decompressor installed by monkey-patching the\n private _get_decompressor() to return an object that only\n implements old BZ2Decompressor API from Python 3.3. Note\n that decompressors without needs_input and two-argument\n decompress() are vulnerable to CVE 2026-15310.\n - gh-156353: Fix configparser parsing when using whitespace\n in delimiters.\n - Build\n - gh-155757: Set the --argv0 argument to wasmtime for WASI\n builds so the test suite passes. Otherwise the calculated\n paths to the stdlib for frozen modules is incorrect.\n","status":"published","published":"2026-10-21T08:04:20Z","modified":"2026-10-21T20:02:16.071878701Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4941-1","title":"Security update for python313","description":"This update for python313 fixes the following issues:\n\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python313:\n\n- Updated to version 3.13.16.\n","status":"published","published":"2026-10-29T14:05:59Z","modified":"2026-10-31T18:00:04.944734428Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4946-1","title":"Security update for python311","description":"This update for python311 fixes the following issues:\n\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another\n  scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python311:\n\n- Update to version 3.11.17.\n","status":"published","published":"2026-10-29T19:05:18Z","modified":"2026-10-31T18:00:05.524603682Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}