Critical Security Update for Python 3.12: Addressing Vulnerabilities in Multiple Packages
Summary
RHSA-2026:77020: Red Hat Security Advisory: python3.12 security update. Affects python-unversioned-command versions < 0:3.12.15-1.el10_2. Fixed in 0:3.12.15-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is a widely used programming language that supports various programming paradigms, including procedural, object-oriented, and functional programming. It is known for its readability and versatility, making it a popular choice for developers across different domains. The recent security advisory highlights vulnerabilities in several related packages, including python-unversioned-command, python3-devel, and python3-tkinter, which could potentially expose systems to security risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities identified in Python 3.12, specifically CVE-2026-19445 and CVE-2026-19553, stem from flaws in the handling of certain operations within the language's core libraries. These vulnerabilities can lead to unauthorized access, data corruption, or even system compromise, depending on the context in which the affected packages are utilized. The severity of these vulnerabilities is underscored by a CVSS score of 8.1, indicating a high risk to systems that rely on these packages.
How To Fix
Minimum fixed version
0:3.12.15-1.el10_2
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their systems by restricting access to the affected packages or by running applications in a controlled environment until the updates can be applied. However, it is highly recommended to implement the updates as soon as possible to ensure complete protection.
Conclusion
The vulnerabilities in Python 3.12 pose significant risks to systems utilizing the affected packages. It is crucial for users to update their installations to the patched version 0:3.12.15-1.el10_2 to ensure security. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for python-unversioned-command →
FAQ
The vulnerabilities are identified as CVE-2026-19445 and CVE-2026-19553, which affect the handling of certain operations in Python's core libraries.
The vulnerabilities have a CVSS score of 8.1, indicating a high severity level and potential risk to affected systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If immediate updates are not possible, consider implementing access restrictions to the affected packages or running applications in a controlled environment until updates can be applied.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:77020.json.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
