This Red Hat security advisory (RHSA-2026:19176) addresses nine vulnerabilities in python3.14 affecting Red Hat Enterprise Linux 9 and related products. The vulnerabilities include header newline injection (CVE-2026-0865), logging bypass in legacy .pyc handling (CVE-2026-2297), incomplete control character validation in http.cookies (CVE-2026-3644), stack overflow in XML parsing (CVE-2026-4224), command-line option injection via webbrowser.open() (CVE-2026-4519), HTTP header injection in proxy tunnel headers (CVE-2026-1502), use-after-free leading to arbitrary code execution or information disclosure in decompression modules (CVE-2026-6100), arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786), and information disclosure and arbitrary code execution via remote debugging (CVE-2026-5713). Red Hat has released updated python3.14 packages to remediate these issues.

The vulnerabilities collectively allow for potential header injection, logging bypass, stack overflow, command injection, arbitrary code execution, and information disclosure within Python applications running on affected Red Hat Enterprise Linux 9 systems. These issues could be exploited to execute arbitrary code, bypass security controls, or disclose sensitive information. However, there are no known exploits in the wild at this time. The security impact is rated as Important by Red Hat.

Red Hat has released updated python3.14 packages for Red Hat Enterprise Linux 9 and related variants that address these vulnerabilities. Users should apply the official security update as described in the Red Hat advisory RHSA-2026:19176 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Since this is an official fix, applying the update is the recommended mitigation. No additional vendor guidance indicates that other actions are required.