The advisory details multiple security flaws in Python 3.12 and related components as shipped by Red Hat, including CVE-2025-6075 which involves quadratic complexity in os.path.expandvars() when processing user-controlled templates, potentially leading to resource exhaustion. Other issues include out-of-memory conditions when loading Plist files (CVE-2025-13837), header injection via newlines in data URL mediatype and http.cookies.Morsel, logging bypass in legacy .pyc file handling, incomplete control character validation in http.cookies, and stack overflow parsing XML. These vulnerabilities affect various Red Hat Enterprise Linux versions and related container images. Red Hat has updated the affected components and container images, recommending deployment via the rhui-installer utility. The advisory includes a comprehensive list of CVEs and CWE identifiers related to resource exhaustion, injection, and memory corruption issues.

The vulnerabilities can lead to denial of service conditions through resource exhaustion (memory or CPU), header injection potentially affecting HTTP headers, logging bypass, and stack overflow. Specifically, CVE-2025-6075 can cause quadratic complexity leading to high resource consumption. CVE-2025-13837 can cause out-of-memory conditions when processing malicious Plist files. The impact is primarily denial of service and potential application instability. There are no confirmed reports of active exploitation in the wild. The vulnerabilities affect Python applications processing untrusted input or files, which may not be common in all environments.

Red Hat has released updated RPM packages and container images addressing these vulnerabilities. Users should deploy the updated container images using the rhui-installer utility as per official Red Hat documentation. Applying these updates will mitigate the described issues. No alternative mitigations are noted in the advisory. Users should follow Red Hat's guidance and update affected systems promptly. Patch status is confirmed as available via the updated packages and images referenced in the advisory.