This Red Hat security advisory addresses nine distinct vulnerabilities in the python3.14 package affecting Red Hat Enterprise Linux 9 and related builds. The issues include: CVE-2026-0865 (header newline injection in wsgiref.headers.Headers), CVE-2026-2297 (logging bypass in legacy .pyc file handling), CVE-2026-3644 (incomplete control character validation in http.cookies), CVE-2026-4224 (stack overflow parsing XML with deeply nested DTD content models), CVE-2026-4519 (command-line option injection in webbrowser.open() via crafted URLs), CVE-2026-1502 (HTTP header injection via CR/LF in proxy tunnel headers), CVE-2026-6100 (arbitrary code execution or information disclosure via use-after-free in decompression modules), CVE-2026-4786 (arbitrary code execution via command injection in webbrowser.open() API), and CVE-2026-5713 (information disclosure and arbitrary code execution via remote debugging with a malicious process). The advisory provides updated python3.14 packages to remediate these vulnerabilities.

The vulnerabilities collectively allow for various impacts including header injection, logging bypass, stack overflow, command injection, HTTP header injection, arbitrary code execution, and information disclosure. These issues could potentially be exploited to execute arbitrary code, bypass security controls, or disclose sensitive information on affected systems running vulnerable versions of python3.14 on Red Hat Enterprise Linux 9. The severity is rated as high by Red Hat Product Security.

Red Hat has released updated python3.14 packages for Red Hat Enterprise Linux 9 and related CodeReady Linux Builder variants that address these vulnerabilities. Users should apply the official security update as detailed in Red Hat advisory RHSA-2026:19176 and the referenced article https://access.redhat.com/articles/11258. Applying this update will mitigate the vulnerabilities. No additional mitigation steps are indicated beyond applying the provided patches.