Critical Security Update for Python 3.12: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:10950: Important: python3.12 security update. Affects python3.12 versions < 3.12.13-2.el8_10. Fixed in 3.12.13-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports modules, classes, exceptions, and dynamic data types, making it a popular choice for developers. However, recent vulnerabilities have been identified that could compromise the security of applications using this version, necessitating immediate attention and updates.
Vulnerability Detail
The vulnerabilities in Python 3.12 stem from various issues, including memory allocation flaws in the Expat library, quadratic complexity in user-controlled template handling, and potential header injections in HTTP cookies. These vulnerabilities could lead to severe consequences such as arbitrary code execution, information disclosure, and denial of service through out-of-memory errors. The vulnerabilities are tracked under multiple CVEs, highlighting the critical nature of the issues.
How To Fix
Minimum fixed version
3.12.13-2.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the input size for parsing documents and avoid using user-controlled templates in critical applications until the update is applied. Additionally, consider using alternative libraries for handling sensitive data.
Conclusion
The vulnerabilities in Python 3.12 pose significant risks to applications relying on this version. It is crucial for users to update to the latest patched version to mitigate these risks. By following the outlined steps and utilizing tools like Vulert, developers can ensure their applications remain secure.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include memory allocation issues, quadratic complexity in template handling, and header injection vulnerabilities, which could lead to arbitrary code execution and information disclosure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If an immediate update is not possible, implement input size restrictions and avoid using vulnerable features until the update can be applied.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the advisory, which provide insights into the impact and technical details.
Yes, you can use the Vulert playground to monitor vulnerabilities in your application without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
