Red Hat Product Security issued an advisory (RHSA-2026:1892) for python3.11 on Red Hat Enterprise Linux 9.6 Extended Update Support, addressing two moderate severity denial of service vulnerabilities: CVE-2025-13836, an excessive read buffering DoS in the http.client module, and CVE-2025-12084, a quadratic algorithm in xml.dom.minidom leading to DoS. The advisory provides updated python3.11 packages to fix these issues. No CVSS scores are provided in the advisory, but the severity is rated moderate. The advisory applies to multiple Red Hat Enterprise Linux 9.6 variants and architectures. Detailed patch instructions are available via Red Hat's update article.

Successful exploitation of these vulnerabilities could cause denial of service conditions in applications using the affected Python 3.11 modules, potentially leading to application or system unavailability. There is no indication of code execution or data compromise. No known exploits in the wild have been reported.

Red Hat has released updated python3.11 packages for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply the official Red Hat security update RHSA-2026:1892 promptly following Red Hat's published guidance to remediate these issues. No additional mitigation steps are specified or required beyond applying the update.