Red Hat Security Advisory: python3.14 security update

Important

Missing newline filtering has been discovered in Python. User-controlled header names and values containing newlines can allow injecting HTTP headers.

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

A flaw was found in Python. This vulnerability allows for the injection of extra information into HTTP communication. Specifically, the system does not properly prevent special characters (carriage return and line feed) from being included in HTTP client proxy tunnel headers or host fields.

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

A flaw was found in CPython. This vulnerability allows a local user with low privileges to bypass security auditing mechanisms. The issue occurs because the SourcelessFileLoader component, responsible for handling older Python compiled files (.pyc), does not properly trigger system audit events. This oversight could enable malicious activities to go undetected, compromising the integrity of the system.

CWE-778 - Insufficient Logging

A control character validation flaw has been discovered in the Python http.cookie module. The Morsel.update(), |= operator, and unpickling paths were not patched to resolve CVE-2026-0672, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

CWE-791 - Incomplete Filtering of Special Elements

A stack overflow flaw has been discovered in the python pyexpat module. When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. This will result in a program crash.

CWE-805 - Buffer Access with Incorrect Length Value