This update for python313 fixes the following issues:
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free
(bsc#1283969).
- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses
(bsc#1283826).
- CV
This update for python313 fixes the following issues:
Security issues fixed:
- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high
CPU usage (bsc#1273148).
- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-17084: [Security-announce][] StringPrep algorithm considered (bsc#1276226).
- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect
sniffing and consume significant CPU (bsc#1274683).
Non security issue fixed:
- Conflicts between different versions of Python (bsc#125836
This update for python313 fixes the following issues:
- CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
- CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
`configparser` module is used (bsc#1269066).
- CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262429).
- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted
Unicode input (bsc#1267581).
This update for python313 fixes the following issues
Security issues:
- CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
- CVE-2026-4786: [oss-security][] CPython: Incomplete mitigation of , %action expansion for command injection to
webbrowser.open() (bsc#1262319).
- CVE-2026-6019: `BaseCookie.js_output()` does not neutralize characters in cookie values embedded in JS (bsc#1262654).
- CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules
(bsc#1262098).
Non s
This update for python313 fixes the following issues:
- Update to v3.13.13
- CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
- CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).
- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
- CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
- CVE-2026-4519: leading dashes in URLs are accept
This update for python313 fixes the following issues:
Update to Python 3.13.12
- CVE-2026-0672: Fixed a HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel. (bsc#1257031)
- CVE-2026-0865: Fixed a bug where a user-controlled header containing newlines can allow injecting HTTP headers. (bsc#1257042)
- CVE-2025-15282: Fixed a bug where a user-controlled data URLs parsed may allow injecting headers. (bsc#1257046)
- CVE-2025-11468: Fixed a header injection when folding a long comment in an email header containing exclusively unfoldable characters. (bsc#1257029)
- CVE-2026-1299: Fixed header injec
This update for python313 fixes the following issues:
Update to version 3.13.11.
Security issues fixed:
- CVE-2025-12084: quadratic complexity when building nested elements using `xml.dom.minidom` methods that depend on
`_clear_id_cache()` can lead to availability issues when building excessively nested documents (bsc#1254997).
- CVE-2025-13836: use of `Content-Length` by default when reading an HTTP response with no read amount specified can
lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
- CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can lead
This update for python313 fixes the following issues:
Update to 3.13.9:
- CVE-2025-6075: Fixed simple quadratic complexity vulnerabilities of os.path.expandvars() (bsc#1252974)
- CVE-2025-8291: Fixed validity of the ZIP64 End of Central Directory (EOCD) not checked by the 'zipfile' module (bsc#1251305)
Other fixes:
- Fix readline history truncation when length is reduced
- Fixing reproducible build for python-nogil (bsc#1244680)
This update for python313 fixes the following issues:
Update to version 3.13.7.
- Fixes in 3.13.7:
* gh-137583: Fix a deadlock introduced in 3.13.6 when a call
to ssl.SSLSocket.recv was blocked in one thread, and then
another method on the object (such as ssl.SSLSocket.send) was
subsequently called in another thread.
* gh-137044: Return large limit values as positive integers
instead of negative integers in resource.getrlimit().
Accept large values and reject negative values (except
RLIM_INFINITY) for limits in resource.setrlimit().
* gh-136914: Fix retrieval of doctest.DocTest.lineno
for objects decorated
This update for python313 fixes the following issues:
- CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
- CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705).
- CVE-2025-4435: Fixed Tarfile extracting filtered members when errorlevel=0 (bsc#1244061).
This update for python313 fixes the following issues:
Update to version 3.13.5.
Security issues fixed:
- CVE-2025-4517: arbitrary filesystem writes outside the extraction directory during extraction with filter='data' (bsc#1244032)
- CVE-2025-4516: use-after-free in the unicode-escape decoder when using the error handler (bsc#1243273).
- CVE-2025-4330: extraction filter bypass for linking outside extraction directory (bsc#1244060)
- CVE-2025-4138: may allow symlink targets to point outside the destination directory, and the modification of some file metadata.
(bsc#1244059)
- CVE-2025-0938: domain names containing square brackets are not