This advisory covers a set of nine security vulnerabilities in python3.14 as packaged by Red Hat for Enterprise Linux 9. The issues include header newline injection in wsgiref.headers.Headers (CVE-2026-0865), logging bypass in legacy .pyc file handling (CVE-2026-2297), incomplete control character validation in http.cookies (CVE-2026-3644), stack overflow when parsing deeply nested XML DTD content models (CVE-2026-4224), command-line option injection via crafted URLs in webbrowser.open() (CVE-2026-4519), HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502), arbitrary code execution or information disclosure due to use-after-free in decompression modules (CVE-2026-6100), arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786), and information disclosure and arbitrary code execution via remote debugging with a malicious process (CVE-2026-5713). Red Hat has released updated python3.14 packages to address these vulnerabilities in Red Hat Enterprise Linux 9 and related variants.

The vulnerabilities collectively allow for various impacts including HTTP header injection, command injection, logging bypass, stack overflow, use-after-free leading to arbitrary code execution, and information disclosure. These could enable attackers to execute arbitrary code, bypass security controls, or disclose sensitive information on affected systems running vulnerable python3.14 versions. The advisory rates the overall impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated python3.14 packages for Red Hat Enterprise Linux 9 and related variants that fix these vulnerabilities. Users should apply the official security update as described in the Red Hat advisory RHSA-2026:19176 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the vendor-provided patches.