RHSA-2026:99691MediumCVSS 6.2

Red Hat Security Advisory: python3 security update

Published
November 12, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (3)

CVE-2026-103995 →CVE-2026-114583 →CVE-2026-116566 →

📋 Description

CVE-2026-103995 — python: python: Misinterpretation of HTTP responses via invalid chunk parsing CVE-2026-114583 — python: python: Arbitrary file write via tarfile extraction filter bypass CVE-2026-116566 — python: python: Security bypass via null byte truncation in socket.getaddrinfo()

🎯 Affected products58

  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 8)
  • platform-python-0:3.6.8-80.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • platform-python-0:3.6.8-80.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • platform-python-0:3.6.8-80.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • platform-python-0:3.6.8-80.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • platform-python-0:3.6.8-80.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • platform-python-debug-0:3.6.8-80.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • platform-python-debug-0:3.6.8-80.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • platform-python-debug-0:3.6.8-80.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • platform-python-debug-0:3.6.8-80.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • platform-python-debug-0:3.6.8-80.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • platform-python-devel-0:3.6.8-80.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • platform-python-devel-0:3.6.8-80.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • platform-python-devel-0:3.6.8-80.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • platform-python-devel-0:3.6.8-80.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • platform-python-devel-0:3.6.8-80.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python3-0:3.6.8-80.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • python3-debuginfo-0:3.6.8-80.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python3-debuginfo-0:3.6.8-80.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • python3-debuginfo-0:3.6.8-80.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python3-debuginfo-0:3.6.8-80.el8_10.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • python3-debuginfo-0:3.6.8-80.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python3-debuginfo-0:3.6.8-80.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • python3-debuginfo-0:3.6.8-80.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python3-debuginfo-0:3.6.8-80.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • python3-debuginfo-0:3.6.8-80.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python3-debuginfo-0:3.6.8-80.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • python3-debugsource-0:3.6.8-80.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python3-debugsource-0:3.6.8-80.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • +28 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Until a fixed Python build is available, avoid extracting untrusted tar archives with the tar extraction filter. If untrusted archives must be processed, perform extraction in an isolated, least-privileged environment with access only to files that may safely be written. Workaround: Reject or sanitize null bytes in host and port values before calling socket.getaddrinfo(), or upgrade to CPython 3.16.0+ or a build carrying the backported fix (upstream PRs #160925/#160926/#160974/#160975/#160977 for 3.15/3.14/3.13/3.12/3.11).

🔗 References (5)