CLSA-2026-1789735614
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1789735614.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789735614
- Upstream
- Published
- 2026-09-18T12:47:09Z
- Modified
- 2026-10-26T09:43:37Z
- Summary
- python3.11: Fix of 5 CVEs
- Details
-
- CVE-2026-87910: tarfile: skip a link member when the extraction filter returns None for its hardlink-extraction fallback instead of ignoring the filter result
- CVE-2026-17084: stringprep: build the RFC 3454 B.2/B.3 tables from Unicode 3.2.0 data so IDNA 2003 encoding of newly case-folding characters no longer depends on the interpreter's Unicode version
- CVE-2026-15310: zipfile: bound the output of each bzip2/LZMA decompress() call so a small crafted member cannot trigger an unbounded allocation
- CVE-2026-9669: bz2: refuse to reuse a BZ2Decompressor after a decompression error, so retrying with the same object can no longer resume from an invalid internal state and write out of bounds
- CVE-2026-11972: tarfile: stop the streaming-mode seek() loop at EOF so a member header declaring a huge size no longer makes parsing take exponentially longer
- References
-
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789735614.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-11972
- https://nvd.nist.gov/vuln/detail/CVE-2026-15310
- https://nvd.nist.gov/vuln/detail/CVE-2026-17084
- https://nvd.nist.gov/vuln/detail/CVE-2026-87910
- https://nvd.nist.gov/vuln/detail/CVE-2026-9669