Vulnerability-Lookup

RHSA-2026:10118

Vulnerability from csaf_redhat - Published: 2026-04-23 11:34 - Updated: 2026-04-23 11:36

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: python3.12: * python3.12-3.12.13-3.1.hum1 (aarch64, x86_64) * python3.12-debug-3.12.13-3.1.hum1 (aarch64, x86_64) * python3.12-devel-3.12.13-3.1.hum1 (aarch64, x86_64) * python3.12-idle-3.12.13-3.1.hum1 (aarch64, x86_64) * python3.12-libs-3.12.13-3.1.hum1 (aarch64, x86_64) * python3.12-test-3.12.13-3.1.hum1 (aarch64, x86_64) * python3.12-tkinter-3.12.13-3.1.hum1 (aarch64, x86_64) * python3.12-3.12.13-3.1.hum1.src (src) Security Fix(es): python3.12: * CVE-2025-13462 * CVE-2026-3446 * CVE-2026-3479

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-13462

A flaw was found in the `tarfile` module of cpython. This vulnerability allows a remote attacker to craft a malicious tar archive that, when processed, could be misinterpreted by the `tarfile` module. This misinterpretation occurs because the module incorrectly applies normalization of `AREGTYPE` blocks to `DIRTYPE` during the processing of multi-block members, such as `GNUTYPE_LONGNAME` or `GNUTYPE_LONGLINK`. The consequence is that the `tarfile` module may process the archive differently than intended, potentially leading to unexpected file system changes or data integrity issues.

2.5 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE-237 - Improper Handling of Structural Elements

Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:10118

CVE-2026-3446

A flaw was found in the Python base64 module. When decoding base64 data using functions like base64.b64decode(), the decoding process prematurely stops upon encountering the first padding character. This can result in incomplete data being processed, where any information following the initial padding is unexpectedly ignored. Consequently, applications might interpret or handle base64-encoded data inconsistently compared to other implementations, potentially leading to data integrity issues.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-1286 - Improper Validation of Syntactic Correctness of Input

Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:10118

CVE-2026-3479

A flaw was found in Python's `pkgutil.get_data()` function, which is used to retrieve data from packages. This function did not properly validate the `resource` argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories stored outside the intended root directory, potentially leading to information disclosure or unintended file access.

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:10118

Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

References

URL

Category

	https://access.redhat.com/errata/RHSA-2026:10118	self
	https://access.redhat.com/security/cve/CVE-2025-13462	external
	https://access.redhat.com/security/cve/CVE-2026-3446	external
	https://access.redhat.com/security/cve/CVE-2026-3479	external
	https://access.redhat.com/security/updates/classi…	external
	https://images.redhat.com/	external
	https://security.access.redhat.com/data/csaf/v2/a…	self
	https://access.redhat.com/security/cve/CVE-2025-13462	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2447082	external
	https://www.cve.org/CVERecord?id=CVE-2025-13462	external
	https://nvd.nist.gov/vuln/detail/CVE-2025-13462	external
	https://github.com/python/cpython/issues/141707	external
	https://github.com/python/cpython/pull/143934	external
	https://mail.python.org/archives/list/security-an…	external
	https://access.redhat.com/security/cve/CVE-2026-3446	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2457410	external
	https://www.cve.org/CVERecord?id=CVE-2026-3446	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-3446	external
	https://github.com/python/cpython/commit/1f9958f9…	external
	https://github.com/python/cpython/commit/4561f641…	external
	https://github.com/python/cpython/commit/e31c5512…	external
	https://github.com/python/cpython/issues/145264	external
	https://github.com/python/cpython/pull/145267	external
	https://mail.python.org/archives/list/security-an…	external
	https://access.redhat.com/security/cve/CVE-2026-3479	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2448746	external
	https://www.cve.org/CVERecord?id=CVE-2026-3479	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-3479	external
	https://github.com/python/cpython/issues/146121	external
	https://github.com/python/cpython/pull/146122	external
	https://mail.python.org/archives/list/security-an…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\npython3.12:\n  * python3.12-3.12.13-3.1.hum1 (aarch64, x86_64)\n  * python3.12-debug-3.12.13-3.1.hum1 (aarch64, x86_64)\n  * python3.12-devel-3.12.13-3.1.hum1 (aarch64, x86_64)\n  * python3.12-idle-3.12.13-3.1.hum1 (aarch64, x86_64)\n  * python3.12-libs-3.12.13-3.1.hum1 (aarch64, x86_64)\n  * python3.12-test-3.12.13-3.1.hum1 (aarch64, x86_64)\n  * python3.12-tkinter-3.12.13-3.1.hum1 (aarch64, x86_64)\n  * python3.12-3.12.13-3.1.hum1.src (src)\n\nSecurity Fix(es):\n\npython3.12:\n  * CVE-2025-13462\n  * CVE-2026-3446\n  * CVE-2026-3479",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:10118",
        "url": "https://access.redhat.com/errata/RHSA-2026:10118"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-13462",
        "url": "https://access.redhat.com/security/cve/CVE-2025-13462"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-3446",
        "url": "https://access.redhat.com/security/cve/CVE-2026-3446"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-3479",
        "url": "https://access.redhat.com/security/cve/CVE-2026-3479"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10118.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-04-23T11:36:43+00:00",
      "generator": {
        "date": "2026-04-23T11:36:43+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.5"
        }
      },
      "id": "RHSA-2026:10118",
      "initial_release_date": "2026-04-23T11:34:58+00:00",
      "revision_history": [
        {
          "date": "2026-04-23T11:34:58+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-23T11:35:35+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-23T11:36:43+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-12-main@aarch64",
                "product": {
                  "name": "python3-12-main@aarch64",
                  "product_id": "python3-12-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12@3.12.13-3.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-12-main@src",
                "product": {
                  "name": "python3-12-main@src",
                  "product_id": "python3-12-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12@3.12.13-3.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-12-main@x86_64",
                "product": {
                  "name": "python3-12-main@x86_64",
                  "product_id": "python3-12-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12@3.12.13-3.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-12-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python3-12-main@aarch64"
        },
        "product_reference": "python3-12-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-12-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python3-12-main@src"
        },
        "product_reference": "python3-12-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-12-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python3-12-main@x86_64"
        },
        "product_reference": "python3-12-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-13462",
      "cwe": {
        "id": "CWE-237",
        "name": "Improper Handling of Structural Elements"
      },
      "discovery_date": "2026-03-12T19:01:27.734807+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447082"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `tarfile` module of cpython. This vulnerability allows a remote attacker to craft a malicious tar archive that, when processed, could be misinterpreted by the `tarfile` module. This misinterpretation occurs because the module incorrectly applies normalization of `AREGTYPE` blocks to `DIRTYPE` during the processing of multi-block members, such as `GNUTYPE_LONGNAME` or `GNUTYPE_LONGLINK`. The consequence is that the `tarfile` module may process the archive differently than intended, potentially leading to unexpected file system changes or data integrity issues.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: cpython: `tarfile` module misinterprets crafted tar archives leading to data integrity issues",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python3-12-main@aarch64",
          "Red Hat Hardened Images:python3-12-main@src",
          "Red Hat Hardened Images:python3-12-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-13462"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447082",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447082"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-13462",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-13462"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13462",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13462"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/141707",
          "url": "https://github.com/python/cpython/issues/141707"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/143934",
          "url": "https://github.com/python/cpython/pull/143934"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/"
        }
      ],
      "release_date": "2026-03-12T17:59:26.620000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T11:34:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10118"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "cpython: cpython: `tarfile` module misinterprets crafted tar archives leading to data integrity issues"
    },
    {
      "cve": "CVE-2026-3446",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-04-10T19:01:22.358644+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457410"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Python base64 module. When decoding base64 data using functions like base64.b64decode(), the decoding process prematurely stops upon encountering the first padding character. This can result in incomplete data being processed, where any information following the initial padding is unexpectedly ignored. Consequently, applications might interpret or handle base64-encoded data inconsistently compared to other implementations, potentially leading to data integrity issues.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python base64: Incomplete data decoding due to premature stop at padding",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python3-12-main@aarch64",
          "Red Hat Hardened Images:python3-12-main@src",
          "Red Hat Hardened Images:python3-12-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3446"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457410",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457410"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3446",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3446"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3446",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3446"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474",
          "url": "https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e",
          "url": "https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa",
          "url": "https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/145264",
          "url": "https://github.com/python/cpython/issues/145264"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/145267",
          "url": "https://github.com/python/cpython/pull/145267"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/"
        }
      ],
      "release_date": "2026-04-10T18:17:35.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T11:34:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10118"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python: Python base64: Incomplete data decoding due to premature stop at padding"
    },
    {
      "cve": "CVE-2026-3479",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-03-18T19:01:35.703411+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448746"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python\u0027s `pkgutil.get_data()` function, which is used to retrieve data from packages. This function did not properly validate the `resource` argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories stored outside the intended root directory, potentially leading to information disclosure or unintended file access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python3-12-main@aarch64",
          "Red Hat Hardened Images:python3-12-main@src",
          "Red Hat Hardened Images:python3-12-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3479"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448746",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448746"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3479",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3479"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3479",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3479"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/146121",
          "url": "https://github.com/python/cpython/issues/146121"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/146122",
          "url": "https://github.com/python/cpython/pull/146122"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/"
        }
      ],
      "release_date": "2026-03-18T18:13:42.288000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T11:34:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10118"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation"
    }
  ]
}

CVE-2026-3479 (GCVE-0-2026-3479)

Vulnerability from cvelistv5 – Published: 2026-03-18 18:13 – Updated: 2026-04-07 22:01 Disputed

Title

pkgutil.get_data() does not enforce documented restrictions

Summary

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.

Severity ?

0 (None)


                        
                          CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

PSF

References

URL

Tags

	https://github.com/python/cpython/pull/146122	patch
	https://mail.python.org/archives/list/security-an…	vendor-advisory
	https://github.com/python/cpython/issues/146121	issue-tracking
	https://github.com/python/cpython/commit/bcdf2319…	patch
	https://github.com/python/cpython/commit/5af6ce3e…	patch
	https://github.com/python/cpython/commit/cf59bf76…	patch
	https://github.com/python/cpython/commit/d786d59a…	patch

Impacted products

	Vendor	Product	Version
	Python Software Foundation	CPython	Affected: 0 , < 3.13.13 (python) Affected: 3.14.0 , < 3.14.4 (python) Affected: 3.15.0a1 , < 3.15.0a8 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3479",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-18T18:50:20.603616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-18T18:50:41.609Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "pkgutil"
          ],
          "product": "CPython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.13.13",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.4",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a8",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.\u003c/p\u003e\u003cp\u003epkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.\u003c/p\u003e"
            }
          ],
          "value": "DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.\n\npkgutil.get_data() did not validate the resource argument as documented, allowing path traversals."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "PHYSICAL",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T22:01:35.724Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/146122"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/146121"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/5af6ce3e7b643a30a02d22245c1e3f4a8bc0a1fe"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/cf59bf76470f3d75ad47d80ffb8ce76b64b5e943"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/d786d59a8f7196bb630100a869f28ad13436b59c"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "disputed"
      ],
      "title": "pkgutil.get_data() does not enforce documented restrictions",
      "x_generator": {
        "engine": "Vulnogram 0.6.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-3479",
    "datePublished": "2026-03-18T18:13:42.288Z",
    "dateReserved": "2026-03-03T14:18:35.394Z",
    "dateUpdated": "2026-04-07T22:01:35.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-13462 (GCVE-0-2025-13462)

Vulnerability from cvelistv5 – Published: 2026-03-12 17:59 – Updated: 2026-04-07 21:59

Title

tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

Summary

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Severity ?

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type
CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-20 - Improper Input Validation

Assigner

PSF

References

URL

Tags

	https://github.com/python/cpython/pull/143934	patch
	https://github.com/python/cpython/issues/141707	issue-tracking
	https://mail.python.org/archives/list/security-an…	vendor-advisory
	https://github.com/python/cpython/commit/42d754e3…	patch
	https://github.com/python/cpython/commit/7ad3093d…	patch
	https://github.com/python/cpython/commit/ae99fe3a…	patch

Impacted products

	Vendor	Product	Version
	Python Software Foundation	CPython	Affected: 0 , < 3.13.13 (python) Affected: 3.14.0 , < 3.14.4 (python) Affected: 3.15.0a1 , < 3.15.0a8 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13462",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-12T19:09:23.808172Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-12T19:09:51.230Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "tarfile"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.13.13",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.4",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a8",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The \"tarfile\" module would still apply normalization of AREGTYPE (\\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations."
            }
          ],
          "value": "The \"tarfile\" module would still apply normalization of AREGTYPE (\\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T21:59:51.173Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/143934"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/141707"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-13462",
    "datePublished": "2026-03-12T17:59:26.620Z",
    "dateReserved": "2025-11-19T22:05:07.578Z",
    "dateUpdated": "2026-04-07T21:59:51.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-3446 (GCVE-0-2026-3446)

Vulnerability from cvelistv5 – Published: 2026-04-10 18:17 – Updated: 2026-04-13 16:07

Title

Base64 decoding stops at first padded quad by default

Summary

When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.

Severity ?

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-345 - Insufficient Verification of Data Authenticity

Assigner

PSF

References

URL

Tags

	https://github.com/python/cpython/pull/145267	patch
	https://github.com/python/cpython/issues/145264	issue-tracking
	https://mail.python.org/archives/list/security-an…	vendor-advisory
	https://github.com/python/cpython/commit/1f9958f9…	patch
	https://github.com/python/cpython/commit/4561f641…	patch
	https://github.com/python/cpython/commit/e31c5512…	patch

Impacted products

	Vendor	Product	Version
	Python Software Foundation	CPython	Affected: 0 , < 3.13.13 (python) Affected: 3.14.0 , < 3.14.4 (python) Affected: 3.15.0a1 , < 3.15.0a8 (python)

Credits

Serhiy Storchaka

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3446",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T16:06:04.489473Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-345",
                "description": "CWE-345 Insufficient Verification of Data Authenticity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T16:07:24.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "base64"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.13.13",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.4",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0a8",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Serhiy Storchaka"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use \"validate=True\" to enable stricter processing of base64 data."
            }
          ],
          "value": "When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use \"validate=True\" to enable stricter processing of base64 data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-10T18:26:41.904Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/145267"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/145264"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Base64 decoding stops at first padded quad by default",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-3446",
    "datePublished": "2026-04-10T18:17:35.045Z",
    "dateReserved": "2026-03-02T16:15:14.567Z",
    "dateUpdated": "2026-04-13T16:07:24.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:10118

CVE-2026-3479 (GCVE-0-2026-3479)

CVE-2025-13462 (GCVE-0-2025-13462)

CVE-2026-3446 (GCVE-0-2026-3446)

Tags

Sightings

Nomenclature