Critical Security Update for Python 3.12: Multiple Vulnerabilities Addressed
Summary
ALSA-2026:19064: Important: python3.12 security update. Affects python-unversioned-command versions < 3.12.13-2.el10_2. Fixed in 3.12.13-2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various programming paradigms and is equipped with extensive libraries and frameworks. However, recent vulnerabilities have been identified in Python 3.12, specifically affecting its handling of memory allocation, header injections, and command injections, which could lead to severe security risks.
Vulnerability Detail
The vulnerabilities in Python 3.12 stem from various issues, including large dynamic memory allocations triggered by small documents, quadratic complexity in user-controlled templates, and potential arbitrary code execution through command injection. These vulnerabilities can be exploited by attackers to execute malicious code, leading to data breaches or system compromises. Notable CVEs include CVE-2025-59375, CVE-2025-6075, and CVE-2026-6100, among others, which highlight the critical nature of these security flaws.
How To Fix
Minimum fixed version
3.12.13-2.el10_2
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input size for documents being parsed and sanitize URLs before processing them in the webbrowser module. However, these are not long-term solutions and should not replace updating the package.
Conclusion
The vulnerabilities identified in Python 3.12 pose significant security risks that could lead to arbitrary code execution and data breaches. It is crucial for users to update to the latest patched version to mitigate these risks. Temporary workarounds can be employed, but they should not replace a proper update.
See every vulnerability recorded for python-unversioned-command →
FAQ
The main vulnerabilities include memory allocation issues, header injection vulnerabilities, and command injection risks, which can lead to arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, implement input validation and limit document sizes as temporary workarounds until you can apply the patch.
While specific exploits may not be publicly available, the vulnerabilities are serious enough that attackers could potentially develop methods to exploit them.
For detailed information, refer to the CVE pages linked in the vulnerability report, which provide insights into the impact and technical details of each CVE.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
