Critical Security Update for python3.12-lxml: CVE-2026-49825
Summary
RHSA-2026:74082: Red Hat Security Advisory: python3.12-lxml security update. Affects python3.12-lxml versions < 0:4.9.3-2.el9_4.1. Fixed in 0:4.9.3-2.el9_4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3.12-lxml package is a Python library that provides a convenient API for processing XML and HTML documents. It is widely used in various applications for its ease of use and powerful features. However, this package has been identified with a critical security vulnerability that could potentially expose applications to significant risks.
Vulnerability Detail
The vulnerability identified as CVE-2026-49825 affects the python3.12-lxml package, allowing attackers to exploit weaknesses in XML and HTML processing. This could lead to unauthorized access to sensitive data or manipulation of application behavior. The vulnerability has a CVSS score of 8.2, indicating a high severity level, and it requires immediate attention to mitigate potential threats.
How To Fix
Minimum fixed version
0:4.9.3-2.el9_4.1
This is the first release that contains the fix.
sudo dnf update python3.12-lxmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider isolating the application from untrusted inputs and limiting access to sensitive data until the update can be applied. Regularly monitor application logs for any unusual activity.
Conclusion
The python3.12-lxml package has a critical vulnerability (CVE-2026-49825) that requires immediate attention. Users should update to the patched version to mitigate risks associated with this vulnerability. Regular monitoring and applying best practices can help secure applications until updates are implemented.
See every vulnerability recorded for python3.12-lxml →
FAQ
CVE-2026-49825 is a security vulnerability in the python3.12-lxml package that could allow attackers to exploit weaknesses in XML and HTML processing.
The vulnerability has a CVSS score of 8.2, indicating a high severity level that requires immediate attention.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Update the python3.12-lxml package to version 0:4.9.3-2.el9_4.1 using the command 'sudo dnf update python3.12-lxml'.
Consider isolating the application from untrusted inputs and limiting access to sensitive data until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-lxml.
