RHLW-2026-4464aa36b46ce416

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-4464aa36b46ce416.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-4464aa36b46ce416.json
JSON Data
https://api.osv.dev/v1/vulns/RHLW-2026-4464aa36b46ce416
Upstream
Published
2026-11-10T15:46:58Z
Modified
2026-11-10T23:00:02Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Lightwell Security Advisory: pyathena 3.35.0+rhlw.1
Details

Red Hat Lightwell has released pyathena 3.35.0+rhlw.1 with a backported security fix.

CVE-2026-65321: PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

This patched artifact is a drop-in replacement for pyathena 3.35.0 from PyPI.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:PyPI / pyathena

Package

Name
pyathena
Purl
pkg:pypi/pyathena

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.35.0+rhlw.1

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.9.0
1.10.0
1.10.1
1.10.2
1.10.3
1.10.4
1.10.5
1.10.6
1.10.7
1.10.8
1.11.0
1.11.1
1.11.2
1.11.3
1.11.4
1.11.5
2.*
2.0.0
2.0.1
2.0.2
2.1.0
2.1.1
2.1.2
2.2.0
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.15.0
2.16.0
2.16.1
2.17.0
2.18.0
2.18.1
2.18.2
2.18.3
2.18.4
2.18.5
2.18.6
2.19.0
2.19.1
2.19.2
2.19.3
2.19.4
2.20.0
2.20.1
2.20.2
2.20.3
2.21.0
2.21.1
2.21.2
2.21.3
2.22.0
2.22.1
2.22.2
2.23.0
2.23.1
2.23.2
2.24.0
2.24.1
2.24.2
2.25.0
2.25.1
2.25.2
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.1.0
3.1.1
3.2.0
3.2.1
3.3.0
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.7.0
3.8.0
3.8.1
3.8.2
3.8.3
3.9.0
3.10.0
3.11.0
3.12.0
3.12.1
3.12.2
3.13.0
3.14.0
3.14.1
3.15.0
3.16.0
3.17.0
3.17.1
3.18.0
3.19.0
3.20.0
3.21.0
3.21.1
3.22.0
3.23.0
3.24.0
3.24.1
3.25.0
3.26.0
3.27.0
3.27.1
3.27.2
3.28.0
3.29.0
3.29.1
3.29.2
3.29.3
3.30.0
3.30.1
3.31.0
3.31.1
3.32.0
3.33.0
3.34.0
3.35.0

Database specific

lightwell 
{
    "backport_base_version": "3.35.0",
    "remediated_version": "3.35.0+rhlw.1",
    "repository_url": "https://packages.redhat.com/lightwell/python/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-4464aa36b46ce416.json"