Moderate Security Update for Python 3.11: Addressing Multiple Command Injection Vulnerabilities
Summary
ALSA-2026:4473: Moderate: python3.11 security update. Affects python3.11 versions < 3.11.13-5.el8_10. Fixed in 3.11.13-5.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.11 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries, making it a versatile choice for developers. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this version.
Vulnerability Detail
The vulnerabilities in Python 3.11 include command injection issues in IMAP and POP3 protocols, as well as header injection vulnerabilities in the wsgiref module. Specifically, the wsgiref.headers.Headers class allows for newline injection in headers (CVE-2026-0865), while user-controlled commands in IMAP and POP3 can lead to command injection (CVE-2025-15366 and CVE-2025-15367). Additionally, unquoted newlines in email headers can result in header injection (CVE-2026-1299). These vulnerabilities can lead to unauthorized access, data manipulation, and potential exploitation of the affected systems.
How To Fix
Minimum fixed version
3.11.13-5.el8_10
This is the first release that contains the fix.
sudo dnf update python3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict the use of affected modules or implement input validation to sanitize user inputs in IMAP and POP3 commands, as well as in email headers. However, updating to the patched version is the recommended approach for long-term security.
Conclusion
In summary, Python 3.11 has several vulnerabilities that could compromise the security of applications using this version. It is crucial to update to the patched version 3.11.13-5.el8_10 to mitigate these risks. For ongoing monitoring of vulnerabilities, consider using tools like Vulert.
See every vulnerability recorded for python3.11 →
FAQ
The main vulnerabilities include command injection in IMAP and POP3 commands and header injection in wsgiref and email headers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
These vulnerabilities can lead to unauthorized access, data manipulation, and exploitation of the affected systems, posing significant security risks.
Yes, the patched version of Python 3.11 is 3.11.13-5.el8_10, which addresses these vulnerabilities.
If immediate updates are not possible, consider implementing input validation and restricting the use of affected modules as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
