CVE-2026-6100
Estado: Pendiente de análisisCrítica (9.1)—
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.
The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression.
Leer descripción completaMostrar menos
Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Puntuación base: 9.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.76%
- Percentil entre todas las CVEs puntuadas: 54
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access60 % - Impacto principal
T1059Command and Scripting Interpreterexecution55 %
Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (4)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-416, CWE-787
- CWE-825
Referencias
- https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e
- https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d
- https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2
- https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20
- https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b
- https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3
- https://github.com/python/cpython/issues/148395
- https://github.com/python/cpython/pull/148396
- https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/
- http://www.openwall.com/lists/oss-security/2026/04/13/10
- https://access.redhat.com/errata/RHSA-2026:10117
- https://access.redhat.com/errata/RHSA-2026:10140
- https://access.redhat.com/errata/RHSA-2026:10141
- https://access.redhat.com/errata/RHSA-2026:10711
- https://access.redhat.com/errata/RHSA-2026:10745
- https://access.redhat.com/errata/RHSA-2026:10774
- https://access.redhat.com/errata/RHSA-2026:10949
- https://access.redhat.com/errata/RHSA-2026:10950
- https://access.redhat.com/errata/RHSA-2026:11062
- https://access.redhat.com/errata/RHSA-2026:11077
- https://access.redhat.com/errata/RHSA-2026:11768
- https://access.redhat.com/errata/RHSA-2026:13692
- https://access.redhat.com/errata/RHSA-2026:13812
- https://access.redhat.com/errata/RHSA-2026:14652
- https://access.redhat.com/errata/RHSA-2026:14653
- https://access.redhat.com/errata/RHSA-2026:14656
- https://access.redhat.com/errata/RHSA-2026:16699
- https://access.redhat.com/errata/RHSA-2026:17525
- https://access.redhat.com/errata/RHSA-2026:17619
- https://access.redhat.com/errata/RHSA-2026:19019
- https://access.redhat.com/errata/RHSA-2026:19064
- https://access.redhat.com/errata/RHSA-2026:19175
- https://access.redhat.com/errata/RHSA-2026:19176
- https://access.redhat.com/errata/RHSA-2026:19177
- https://access.redhat.com/errata/RHSA-2026:19216
- https://access.redhat.com/errata/RHSA-2026:19549
- https://access.redhat.com/errata/RHSA-2026:19570
- https://access.redhat.com/errata/RHSA-2026:19571
- https://access.redhat.com/errata/RHSA-2026:19576
- https://access.redhat.com/errata/RHSA-2026:19590
- https://access.redhat.com/errata/RHSA-2026:21275
- https://access.redhat.com/errata/RHSA-2026:21682
- https://access.redhat.com/errata/RHSA-2026:25096
- https://access.redhat.com/errata/RHSA-2026:26187
- https://access.redhat.com/errata/RHSA-2026:30078
- https://access.redhat.com/errata/RHSA-2026:30087
- https://access.redhat.com/errata/RHSA-2026:30088
- https://access.redhat.com/errata/RHSA-2026:30089
- https://access.redhat.com/errata/RHSA-2026:52400
- https://access.redhat.com/errata/RHSA-2026:8822
- https://access.redhat.com/errata/RHSA-2026:8824
- https://access.redhat.com/errata/RHSA-2026:9228
- https://access.redhat.com/security/cve/CVE-2026-6100
- https://bugzilla.redhat.com/show_bug.cgi?id=2457932
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-6100",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-6100",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-04-13T19:21:03.412763Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.2
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "cna@python.org",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 9.1,
"Automatable": "NOT_DEFINED",
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "cna@python.org",
"affectedData": [
{
"repo": "https://github.com/python/cpython",
"vendor": "Python Software Foundation",
"product": "CPython",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "3.10.21",
"versionType": "python"
},
{
"status": "affected",
"version": "3.11.0",
"lessThan": "3.11.16",
"versionType": "python"
},
{
"status": "affected",
"version": "3.12.0",
"lessThan": "3.12.14",
"versionType": "python"
},
{
"status": "affected",
"version": "3.13.0",
"lessThan": "3.13.14",
"versionType": "python"
},
{
"status": "affected",
"version": "3.14.0a1",
"lessThan": "3.14.5rc1",
"versionType": "python"
},
{
"status": "affected",
"version": "3.15.0a1",
"lessThan": "3.15.0b1",
"versionType": "python"
}
],
"defaultStatus": "unaffected"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1",
"cpe:/o:redhat:enterprise_linux:10.2"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"versions": [
{
"status": "unaffected",
"version": "0:3.12.12-3.el10_1.3",
"lessThan": "*",
"versionType": "rpm"
},
{
"status": "unaffected",
"version": "0:3.12.13-2.el10_2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.12",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"versions": [
{
"status": "unaffected",
"version": "0:3.14.4-2.el10_2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.14",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:3.12.9-2.el10_0.9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.12",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.12.13-2.el8_10",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.12",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.11.13-7.el8_10",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.11",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8",
"cpe:/o:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.6.8-76.el8_10",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:3.6.8-39.el8_4.11",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"versions": [
{
"status": "unaffected",
"version": "0:3.6.8-39.el8_4.11",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:3.6.8-47.el8_6.13",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "0:3.6.8-47.el8_6.13",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:3.6.8-47.el8_6.13",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "0:3.6.8-51.el8_8.15",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "0:3.11.2-2.el8_8.10",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.11",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:3.6.8-51.el8_8.15",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:3.11.2-2.el8_8.10",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.11",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.12.12-4.el9_7.3",
"lessThan": "*",
"versionType": "rpm"
},
{
"status": "unaffected",
"version": "0:3.12.13-2.el9_8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.12",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.11.13-5.3.el9_7",
"lessThan": "*",
"versionType": "rpm"
},
{
"status": "unaffected",
"version": "0:3.11.13-9.el9_8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.11",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.9.25-3.el9_7.3",
"lessThan": "*",
"versionType": "rpm"
},
{
"status": "unaffected",
"version": "0:3.9.25-7.el9_8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.14.4-2.el9_8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.14",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:3.9.10-4.el9_0.11",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:3.11.2-2.el9_2.12",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.11",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:3.9.16-1.el9_2.14",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:3.11.7-1.el9_4.13",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.11",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:3.12.1-4.el9_4.13",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.12",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:3.9.18-3.el9_4.13",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:3.11.11-2.el9_6.7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.11",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:3.12.9-1.el9_6.8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.12",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:3.9.21-2.el9_6.6",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3.9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
],
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"versions": [
{
"status": "unaffected",
"version": "7.13.5-4.1777325677",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhpam-7/rhpam-businesscentral-monitoring-rhel8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
],
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"versions": [
{
"status": "unaffected",
"version": "7.13.5-4.1777325711",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhpam-7/rhpam-businesscentral-rhel8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
],
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"versions": [
{
"status": "unaffected",
"version": "7.13.5-4.1777325710",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhpam-7/rhpam-controller-rhel8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
],
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"versions": [
{
"status": "unaffected",
"version": "7.13.5-3.1777325680",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhpam-7/rhpam-dashbuilder-rhel8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
],
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"versions": [
{
"status": "unaffected",
"version": "7.13.5-4.1777325709",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhpam-7/rhpam-kieserver-rhel8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
],
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"versions": [
{
"status": "unaffected",
"version": "7.13.5-4.1777325680",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhpam-7/rhpam-process-migration-rhel8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
],
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"versions": [
{
"status": "unaffected",
"version": "7.13.5-4.1777325708",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhpam-7/rhpam-smartrouter-rhel8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.2::el9"
],
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server 3.2",
"versions": [
{
"status": "unaffected",
"version": "1780681984",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhaiis/model-opt-cuda-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server 3.3",
"versions": [
{
"status": "unaffected",
"version": "1782352950",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhaiis/model-opt-cuda-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server 3.3",
"versions": [
{
"status": "unaffected",
"version": "1782352919",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhaiis/vllm-spyre-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server 3.3",
"versions": [
{
"status": "unaffected",
"version": "1782353093",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhaiis/vllm-rocm-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server 3.3",
"versions": [
{
"status": "unaffected",
"version": "1782352847",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhaiis/vllm-cuda-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI 3.3",
"versions": [
{
"status": "unaffected",
"version": "1776871984",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhelai3/bootc-aws-cuda-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI 3.3",
"versions": [
{
"status": "unaffected",
"version": "1776871985",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhelai3/bootc-azure-cuda-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI 3.3",
"versions": [
{
"status": "unaffected",
"version": "1776872005",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhelai3/bootc-azure-rocm-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI 3.3",
"versions": [
{
"status": "unaffected",
"version": "1776773390",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhelai3/bootc-cuda-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI 3.3",
"versions": [
{
"status": "unaffected",
"version": "1776871987",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhelai3/bootc-gcp-cuda-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI 3.3",
"versions": [
{
"status": "unaffected",
"version": "1776773505",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhelai3/bootc-rocm-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI 3.3",
"versions": [
{
"status": "unaffected",
"version": "1776938871",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhelai3/disk-image-cuda-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"versions": [
{
"status": "unaffected",
"version": "3.13.13-1.1.hum1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3-13-main",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"versions": [
{
"status": "unaffected",
"version": "3.11.15-4.hum1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3-11-main",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"versions": [
{
"status": "unaffected",
"version": "3.12.13-3.hum1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3-12-main",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"versions": [
{
"status": "unaffected",
"version": "3.14.4-2.hum1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "python3-14-main",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Update Infrastructure 5",
"versions": [
{
"status": "unaffected",
"version": "1777459441",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhui5/cds-kubernetes-tp-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Update Infrastructure 5",
"versions": [
{
"status": "unaffected",
"version": "1777454300",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhui5/installer-tp-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Update Infrastructure 5",
"versions": [
{
"status": "unaffected",
"version": "1777459504",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhui5/rhua-tp-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Update Infrastructure 5",
"versions": [
{
"status": "unaffected",
"version": "1779798159",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhui5/cds-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Update Infrastructure 5",
"versions": [
{
"status": "unaffected",
"version": "1779798164",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhui5/haproxy-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Update Infrastructure 5",
"versions": [
{
"status": "unaffected",
"version": "1779798165",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhui5/installer-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Update Infrastructure 5",
"versions": [
{
"status": "unaffected",
"version": "1779798222",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhui5/rhua-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "python",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "python",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "python3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"packageName": "python36:3.6/python36",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"packageName": "python39-devel:3.9/python39",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"packageName": "redhat-user-workloads/bootc-cuda-aws-3-3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"packageName": "redhat-user-workloads/bootc-cuda-azure-3-3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"packageName": "redhat-user-workloads/bootc-cuda-gcp-3-3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"packageName": "redhat-user-workloads/bootc-rocm-azure-3-3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
}
]
}
],
"published": "2026-04-13T18:16:31.297",
"references": [
{
"url": "https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e",
"source": "cna@python.org"
},
{
"url": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
"source": "cna@python.org"
},
{
"url": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
"source": "cna@python.org"
},
{
"url": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
"source": "cna@python.org"
},
{
"url": "https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b",
"source": "cna@python.org"
},
{
"url": "https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3",
"source": "cna@python.org"
},
{
"url": "https://github.com/python/cpython/issues/148395",
"source": "cna@python.org"
},
{
"url": "https://github.com/python/cpython/pull/148396",
"source": "cna@python.org"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/",
"source": "cna@python.org"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/13/10",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:10117",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:10140",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:10141",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:10711",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:10745",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:10774",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:10949",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:10950",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:11062",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:11077",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:11768",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:13692",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:13812",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:14652",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:14653",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:14656",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:16699",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:17525",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:17619",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19019",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19064",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19175",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19176",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19177",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19216",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19549",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19570",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19571",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19576",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19590",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:21275",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:21682",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25096",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26187",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30078",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30087",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30088",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30089",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:52400",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:8822",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:8824",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:9228",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-6100",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
],
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"type": "Secondary",
"source": "cna@python.org",
"description": [
{
"lang": "en",
"value": "CWE-416"
},
{
"lang": "en",
"value": "CWE-787"
}
]
},
{
"type": "Secondary",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"description": [
{
"lang": "en",
"value": "CWE-825"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.\n\nThe vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable."
}
],
"lastModified": "2026-08-13T01:16:54.850",
"sourceIdentifier": "cna@python.org"
}