Critical Security Update for Python 3.12: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:19177: Important: python3.12 security update. Affects python3.12 versions < 3.12.13-2.el9_8. Fixed in 3.12.13-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, and dynamic data types. It is widely used for various applications, from web development to data analysis. However, recent vulnerabilities have been identified that could potentially compromise the security of applications using this version.
Vulnerability Detail
The vulnerabilities in Python 3.12 stem from various issues, including memory allocation problems, header injection vulnerabilities, and command injection risks. These vulnerabilities can lead to severe consequences such as arbitrary code execution, information disclosure, and denial of service. Specific vulnerabilities include CVE-2025-59375, which allows attackers to trigger large memory allocations, and CVE-2026-6100, which can lead to arbitrary code execution through use-after-free in decompression modules.
How To Fix
Minimum fixed version
3.12.13-2.el9_8
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the affected features until the update is applied. For instance, refrain from using the 'webbrowser.open()' API with untrusted URLs to mitigate the risk of command injection.
Conclusion
The vulnerabilities in Python 3.12 pose significant risks to applications relying on this version. It is crucial to update to the latest patched version to ensure security and stability. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include memory allocation issues, header injection vulnerabilities, and command injection risks, which can lead to arbitrary code execution and information disclosure.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
It is recommended to update to the patched version 3.12.13-2.el9_8 as soon as possible to mitigate the identified vulnerabilities.
Yes, temporarily avoid using the affected features, such as the 'webbrowser.open()' API with untrusted URLs, until the update is applied.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about each specific issue.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
