This Red Hat security advisory (RHSA-2026:10117) updates multiple python3.13 RPM packages in Red Hat Hardened Images to address three vulnerabilities: CVE-2026-1502, CVE-2026-4786, and CVE-2026-6100. CVE-2026-1502 is a CRLF injection vulnerability (CWE-93) in Python that allows injection of carriage return and line feed characters into HTTP client proxy tunnel headers or host fields, potentially modifying application data integrity. The advisory lists updated RPMs for python3.13 version 3.13.13-1.1.hum1 for aarch64 and x86_64 architectures. Red Hat notes that mitigation for CVE-2026-1502 is either unavailable or does not meet their criteria for deployment. No explicit fixed version range is provided, and no known exploits in the wild are reported. The advisory references upstream Python commits addressing the issue. Red Hat scores this vulnerability as high severity with a CVSS v3 vector of AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:NU.

The vulnerabilities addressed affect the integrity of HTTP communications by allowing injection of special characters into HTTP headers, which can modify application data. This could lead to unexpected behavior or security issues in applications using the affected Python versions. No confidentiality or availability impacts are reported. No known active exploitation is documented. The impact is rated high by Red Hat due to the integrity impact and network attack vector requiring high privileges and user interaction.

A security update is available for Red Hat Hardened Images RPMs including python3.13 packages. Users should apply the updated RPMs (python3.13-3.13.13-1.1.hum1 and related packages) to remediate these vulnerabilities. For CVE-2026-1502, no effective mitigation other than applying the update is currently available or meets Red Hat's criteria. Users should follow Red Hat's official update instructions at https://images.redhat.com/. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.