This Red Hat security advisory (RHSA-2026:19019) addresses nine distinct vulnerabilities in python3.14 packages distributed with Red Hat Enterprise Linux 10 and related products. The issues include: CVE-2026-0865 (header newline injection in wsgiref.headers.Headers), CVE-2026-2297 (logging bypass in legacy .pyc file handling), CVE-2026-3644 (incomplete control character validation in http.cookies), CVE-2026-4224 (stack overflow parsing deeply nested XML DTD content models), CVE-2026-4519 (command-line option injection in webbrowser.open()), CVE-2026-1502 (HTTP header injection via CR/LF in proxy tunnel headers), CVE-2026-6100 (use-after-free in decompression modules leading to arbitrary code execution or information disclosure), CVE-2026-4786 (arbitrary code execution via command injection in webbrowser.open() API), and CVE-2026-5713 (information disclosure and arbitrary code execution via remote debugging with a malicious process). The advisory includes updated python3.14 packages to remediate these vulnerabilities across multiple architectures and product variants.

The vulnerabilities collectively allow for various security impacts including header injection, logging bypass, stack overflow, command injection, arbitrary code execution, and information disclosure. These issues could potentially be exploited to execute arbitrary code, bypass security controls, or disclose sensitive information when using affected python3.14 components on Red Hat Enterprise Linux 10 systems. The advisory rates the overall impact as Important.

Red Hat has released updated python3.14 packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 10 and related products should apply the provided security update as soon as possible. Detailed update instructions are available in the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.