CLSA-2026-1781174666
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1781174666
- Upstream
- Published
- 2026-06-11T10:47:05Z
- Modified
- 2026-10-26T09:32:03Z
- Summary
- Fix CVE(s): CVE-2025-13462, CVE-2026-0672, CVE-2026-3644, CVE-2026-4224
- Details
-
- SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply
nested DTD content models
- debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to bound recursion when a registered ElementDeclHandler converts a deeply nested content model.
- CVE-2026-4224
- SECURITY UPDATE: HTTP header injection via control characters in cookies
- debian/patches/CVE-2026-0672.patch: add _has_control_character() and reject control characters in Morsel.setitem()/setdefault()/set() and BaseCookie.output() in Lib/http/cookies.py.
- CVE-2026-0672
- SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in
cookies via additional Morsel paths)
- debian/patches/CVE-2026-3644.patch: reject control characters in Morsel.update(), Morsel.setstate() and Morsel.js_output() in Lib/http/cookies.py.
- CVE-2026-3644
- SECURITY UPDATE: tarfile member type confusion (regular file parsed as
directory) via GNU long name/link headers
- debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers (dircheck=False) in Lib/tarfile.py.
- CVE-2025-13462
- SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply
nested DTD content models
- References