Tuxcare Errata System 0.0.1 5.10 2026-07-24T13:19:15 Community Enterprise Operating System 7 - CVE-2023-24329: make urllib.parse.urlparse enforce that a scheme must begin with an alphabetical ASCII character - CVE-2023-40217: check for & avoid the ssl pre-close flaw - CVE-2024-6232: remove backtracking when parsing tarfile headers - CVE-2024-7592: fix quadratic complexity in parsing double-quoted cookie values with backslashes Important TuxCare License Agreement CVE-2021-28861 CVE-2022-45061 CVE-2023-27043 CVE-2024-9287 CVE-2024-6232 CVE-2024-7592 CVE-2023-24329 CVE-2023-40217 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2007-4559: implement PEP 706 - a filter in the tarfile module to prevent directory traversal vulnerability - CVE-2023-6597: prevent tempfile.TemporaryDirectory class dereference symlinks Important TuxCare License Agreement CVE-2007-4559 CVE-2023-6597 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2019-9674: add pitfalls to zipfile module documentation Important TuxCare License Agreement CVE-2019-9674 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2022-45061: fix quadratic time idna decoding - CVE-2019-9674: add pitfalls to zipfile module documentation Critical TuxCare License Agreement CVE-2022-48560 CVE-2024-7592 CVE-2024-6232 CVE-2022-48565 CVE-2023-24329 CVE-2022-45061 CVE-2022-0391 CVE-2019-9674 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2023-27043: reject malformed addresses in email.parseaddr() - CVE-2020-8492: fix regex in AbstractBasicAuthHandler - CVE-2021-3733: fix regex in AbstractBasicAuthHandler Moderate TuxCare License Agreement CVE-2022-48566 CVE-2023-40217 CVE-2021-3733 CVE-2020-8492 CVE-2023-27043 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2021-3737: stop reading a header if it's too long - CVE-2019-20907: avoid infinite loop in the tarfile module - Build and testing fixes in spec Important TuxCare License Agreement CVE-2019-20907 CVE-2021-3737 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2020-26116: prevent http header injection in httplib Important TuxCare License Agreement CVE-2020-26116 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - Fix CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517: fix multiple tarfile extraction filter bypasses (filter="tar"/filter="data") - fix test_tarfile.py Important TuxCare License Agreement CVE-2025-4330 CVE-2025-4517 CVE-2025-4435 CVE-2025-4138 CVE-2024-12718 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-13837: fix memory denial of service in plistlib Moderate TuxCare License Agreement CVE-2025-13837 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2015-20107: mailcap: sanitize the second argument which allowing shell commands injection Important TuxCare License Agreement CVE-2015-20107 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2015-20107: sanitize the second argument, which allows shell command injection in the mailcap module Important TuxCare License Agreement CVE-2015-20107 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-12084: remove quadratic behavior in xml.minidom node ID cache clearing Moderate TuxCare License Agreement CVE-2025-12084 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-6075: fix quadratic complexity in os.path.expandvars() Moderate TuxCare License Agreement CVE-2025-6075 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-8194: tarfile: validate archives to ensure member offsets are non-negative Important TuxCare License Agreement CVE-2025-8194 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-8194: tarfile: validate archives to ensure member offsets are non-negative Important TuxCare License Agreement CVE-2025-8194 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-6075: fix quadratic complexity in os.path.expandvars() Moderate TuxCare License Agreement CVE-2025-6075 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-4519: reject leading dashes in webbrowser.open() URLs to prevent command-line option injection in browser subprocesses Low TuxCare License Agreement CVE-2026-4519 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-4519: reject leading dashes in webbrowser.open() URLs to prevent command-line option injection in browser subprocesses Important TuxCare License Agreement CVE-2026-4519 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2024-0450: zipfile raises BadZipFile on quoted-overlap archive entries to prevent high-ratio zip bombs - CVE-2026-6100: use-after-free in lzma/bz2 decompressors when a MemoryError leaves a stale next_in pointer on a re-used decompressor Critical TuxCare License Agreement CVE-2026-6100 CVE-2024-0450 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-6100: NULL bzs->next_in in error paths in BZ2Decomp_decompress. Critical TuxCare License Agreement CVE-2026-6100 CVE-2020-27619 CVE-2024-0450 CVE-2021-3177 CVE-2021-4189 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-1299: email.Generator now rejects header *values* containing CR/LF that are not followed by folding whitespace by raising HeaderWriteError. In Python 2.7 (which lacks BytesGenerator) this single Generator-class hardening covers both upstream CVE-2026-1299 and CVE-2024-6923. - CVE-2024-6923: email.Generator now rejects header *names* containing CR/LF that are not followed by folding whitespace by raising HeaderWriteError, preventing header injection through the header name. - CVE-2024-0397: ssl.SSLContext.cert_store_stats and get_ca_certs now deep-copy the X509_STORE under X509_STORE_lock (via a backport of OpenSSL 3.3's X509_STORE_get1_objects), fixing a memory race when an SSLContext is shared across threads. - CVE-2021-28861: BaseHTTPServer now collapses any leading run of '/' in the request path to a single '/' to prevent an open-redirect via //evil.example/... URIs in 301 Location headers. Important TuxCare License Agreement CVE-2024-6923 CVE-2021-28861 CVE-2024-0397 CVE-2026-1299 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-1299: email.BytesGenerator now refuses to serialize headers that are unsafely folded or contain unfolded newlines, closing a header-injection bypass of CVE-2024-6923 (also includes the CVE-2024-6923 prerequisite hardening of the string Generator) - CVE-2024-0397: ssl.SSLContext.cert_store_stats() and get_ca_certs() now correctly lock the certificate store via a backported X509_STORE_get1_objects shim, fixing a memory race when an SSLContext is shared across threads - CVE-2024-4032: ipaddress is_private/is_global now classify addresses per the IANA special-purpose registries (192.0.0.0/24 with 192.0.0.9 and 192.0.0.10 exceptions, 64:ff9b:1::/48, 2002::/16, and the 2001::/23 sub-range exceptions) Important TuxCare License Agreement CVE-2024-4032 CVE-2024-0397 CVE-2026-1299 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-3446: binascii.a2b_base64 / base64.b64decode no longer abort the decoder loop on the first padded quad. The pad character is treated as non-alphabet data per RFC 4648 section 3.3, so excess data after the padding is decoded instead of being silently dropped. Moderate TuxCare License Agreement CVE-2026-3446 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-3446: binascii.a2b_base64 / base64.b64decode no longer abort the decoder loop on the first padded quad. The pad character is treated as non-alphabet data per RFC 4648 section 3.3, so excess data after the padding is decoded instead of being silently dropped. Moderate TuxCare License Agreement CVE-2026-3446 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-15282: urllib.request.DataHandler accepted data: URLs whose mediatype contained C0 control characters, allowing newline-based HTTP header injection downstream. Reject control characters in data_open(). - CVE-2026-0672: http.cookies.Morsel did not reject control characters in keys, values, or coded_value, allowing cookie injection via __setitem__, setdefault, set, and BaseCookie.output. Add a _has_control_character helper and validate in those entry points and BaseCookie.OutputString. - CVE-2026-3644: the CVE-2026-0672 fix was incomplete; control characters could still bypass via Morsel.update(), |=, __setstate__, and BaseCookie.js_output(). Validate those entry points too and re-validate the assembled output string in js_output(). - CVE-2026-4224: Modules/pyexpat.c conv_content_model could overflow the C stack when an Expat parser with a registered ElementDeclHandler parsed a deeply nested DTD content model, causing a denial-of-service. Wrap conv_content_model with Py_EnterRecursiveCall so deep nesting raises RecursionError instead of crashing. Moderate TuxCare License Agreement CVE-2025-15282 CVE-2026-3644 CVE-2026-4224 CVE-2026-0672 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-4224: Modules/pyexpat.c conv_content_model could overflow the C stack when an Expat parser with a registered ElementDeclHandler parsed a deeply nested DTD content model, causing a denial-of-service. Wrap conv_content_model with Py_EnterRecursiveCall so deep nesting raises RuntimeError instead of crashing. - CVE-2026-0672 + CVE-2026-3644: Lib/Cookie.py Morsel accepted control characters in reserved-attribute values, in key/value/coded_value via .set(), and via the inherited dict.update() / pickle restoration paths, allowing newline-based HTTP header injection via Set-Cookie. Add a _has_control_character helper and validate at Morsel.__setitem__, .setdefault, .set, an explicit .update, an explicit .__setstate__, plus re-validate the assembled output in Morsel.js_output and BaseCookie.output (defence-in-depth against direct attribute mutation). The py3 __ior__ hunk is not ported (py2 dict has no `|=` operator). Moderate TuxCare License Agreement CVE-2026-3644 CVE-2026-4224 CVE-2026-0672 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-7210 + CVE-2026-41080 (paired): backport libexpat 16-byte salt API (XML_SetHashSalt16Bytes) into bundled expat 2.4.1 and wire pyexpat/_elementtree to use it. Together these restore proper hash-flood mitigation for xml.parsers.expat and xml.etree.ElementTree. CVE-2026-7210 (cpython 24b8f12): xml.parsers.expat and xml.etree.ElementTree used insufficient entropy (a single Py_hash_t) for Expat hash-flooding protection. The cpython half of the fix seeds the parser with the full 16-byte _Py_HashSecret.expat.hashsalt16 via XML_SetHashSalt16Bytes when the libexpat being linked exposes that API. CVE-2026-41080 (libexpat PR #1183): libexpat's hash-flood protection itself only used 4-8 bytes of entropy for the SipHash salt. The libexpat half adds the new XML_SetHashSalt16Bytes API (and widens the parser's internal salt storage to a full struct sipkey) so the 16-byte path is available. Backported into the bundled libexpat 2.4.1 tree in Modules/expat/; the bundled expat.h now also defines XML_HAS_HASHSALT16BYTES_BACKPORT so the cpython 20800 gate activates against the patched bundle without bumping the advertised libexpat version. Alpine builds use --with-system-expat and are unaffected by the libexpat backport. Critical TuxCare License Agreement CVE-2026-7210 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-13462: tarfile applied AREGTYPE -> DIRTYPE normalization even during multi-block GNU long members (LONGNAME / LONGLINK), enabling a parsing differential. Thread a dircheck flag through frombuf / fromtarfile so normalization is skipped on follow-up headers. - CVE-2026-0865: wsgiref.headers.Headers did not reject control characters in header names / values, allowing HTTP header injection from WSGI applications. Combined backport: gh-143917 adds the control-char regex check, gh-143916 HTAB follow-up splits the check so HTAB is allowed in header values (RFC 9110 Section 5.5) but still rejected in header names; LF / CR / DEL remain rejected in both. gh-144370 also disallows control characters in status in wsgiref.handlers. - CVE-2026-1502: http.client did not reject CR/LF in HTTPConnection CONNECT tunnel host / headers, enabling request injection. Validate the tunnel host and per-header name / value in _tunnel(). - CVE-2026-6019: http.cookies.Morsel.js_output() emitted an inline <script> snippet that only escaped " and left </script> intact, enabling HTML injection. Base64-encode the cookie value in the emitted JavaScript (gh-90309). Moderate TuxCare License Agreement CVE-2025-4516 CVE-2025-13462 CVE-2026-1502 CVE-2024-50602 CVE-2024-11168 CVE-2026-0865 CVE-2025-8291 CVE-2025-6069 CVE-2025-1795 CVE-2025-0938 CVE-2026-6019 CVE-2025-11468 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-15366: imaplib.IMAP4._command() concatenated each argument into the wire-level command without inspecting it, so user-controlled text (e.g. a username passed to IMAP4.login()) containing CR/LF or other control characters could inject a second IMAP command. A module-level _control_chars regex and a guard in _command() now reject any argument containing a byte in [\x00-\x1F\x7F] with ValueError before concatenation. - CVE-2025-15367: poplib.POP3._putcmd() sent its argument to the server without inspecting it, so user-controlled text passed to user()/pass_()/apop()/rpop()/top() could inject a second POP3 command. _putcmd() now rejects any argument containing a byte in [\x00-\x1F\x7F] with ValueError before sending. Important TuxCare License Agreement CVE-2025-15366 CVE-2025-15367 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-15366: imaplib.IMAP4._command() concatenated each command argument into the wire-level command without inspecting it, so a caller passing user-controlled text could inject extra IMAP commands using CR/LF or other control characters. Reject any byte in [\x00-\x1F\x7F] with ValueError before concatenation (upstream gh-143921 / 6262704b; mirrors RHSA-2026:6464 python3-3.6.8-21.el7_9.4). - CVE-2025-15367: poplib.POP3._putcmd() encoded its argument and sent it to the server without inspecting it, allowing the same command injection via user()/pass_()/apop()/rpop()/top(). Reject any byte in [\x00-\x1F\x7F] with ValueError before sending (upstream gh-143923 / b234a2b6; mirrors RHSA-2026:6464 python3-3.6.8-21.el7_9.4). Important TuxCare License Agreement CVE-2025-15366 CVE-2025-15367 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-9669: the bz2 BZ2Decompressor could be reused after a libbz2 decompression error; re-entering BZ2_bzDecompress() in that state can write past the end of a stack buffer (CWE-121). The decompressor now records the libbz2 error and refuses further decompress() calls with ValueError, becoming unusable after the first error (upstream gh-150599 / 5755d0f0, adapted to 3.6: plain needs_input reset and existing ACQUIRE_LOCK/RELEASE_LOCK wrappers, NEWS.d fragment omitted). Important TuxCare License Agreement CVE-2026-9669 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2024-11168: urlparse.urlsplit() did not validate the content of bracketed hosts, so domain names that are neither valid IPv6 nor IPvFuture literals were accepted inside "[" "]". A new _check_bracketed_host() is added (Lib/urlparse.py) and called from both the "http" fast-path and the generic branch of urlsplit(). Python 2.7 has no ipaddress module, so the bracket content is validated with socket.inet_pton() (IPv4 in brackets is rejected; otherwise the content must parse as IPv6). - CVE-2024-50602: a NULL pointer dereference in the bundled libexpat (Modules/expat/, 2.2.8) when XML_StopParser() was called on a parser in the XML_INITIALIZED state followed by XML_ResumeParser(). XML_StopParser() now refuses to stop/suspend an unstarted parser, returning the new XML_ERROR_NOT_STARTED. Backport of libexpat PR - CVE-2025-0938: completes CVE-2024-11168 by also rejecting square brackets in plain domain names. _check_bracketed_netloc() (Lib/urlparse.py) mirrors NetlocResultMixins._hostinfo() so data before/after the brackets is rejected; it replaces the inline bracket extraction in both branches of urlsplit(). Moderate TuxCare License Agreement CVE-2024-50602 CVE-2024-11168 CVE-2025-0938 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2013-0340: backport libexpat's billion-laughs / internal-entity-expansion amplification protection into the bundled expat 2.2.8 tree (Modules/expat/). xmlparse.c/expat.h/internal.h gain the libexpat 2.4.0 accounting machinery (XML_SetBillionLaughsAttackProtectionMaximumAmplification / ...ActivationThreshold, default 100x after 8 MiB) and a new XML_ERROR_AMPLIFICATION_LIMIT_BREACH; entity expansion that exceeds the amplification limit is now rejected instead of expanding unbounded. Adapted to coexist with the CloudLinux XML_SetHashSalt16Bytes extension; the system expat is NOT used. New public symbols are namespaced in pyexpatns.h. - CVE-2026-0865: reject C0/DEL control characters in wsgiref.headers.Headers (Lib/wsgiref/headers.py); HTAB stays legal in values but not names. Backport of gh-143916 (GH-143917) plus the HTAB follow-up (GH-144762). - CVE-2026-1502: reject CR/LF and other illegal characters in HTTP CONNECT tunnel host and request headers in HTTPConnection._tunnel() (Lib/httplib.py), using the existing _contains_disallowed_url_pchar_re / _is_legal_header_name / _is_illegal_header_value helpers. Backport of gh-146211 (GH-146212). - CVE-2026-6019: base64-encode the cookie value embedded in Cookie.Morsel.js_output() and emit it via atob() to prevent template injection (Lib/Cookie.py). Backport of gh-90309 (GH-148889), on top of CVE-2026-3644. - CVE-2026-9669: prevent bz2.BZ2Decompressor reuse after a decompression error (Modules/bz2module.c). After libbz2 reports an error the stream is inconsistent and re-entering it can overflow the output buffer; the decompressor now records the error and raises ValueError on any further decompress() call. Port of gh-150599 (GH-150600) to the 2.7 bz2 wrapper. Important TuxCare License Agreement CVE-2025-13462 CVE-2026-1502 CVE-2026-9669 CVE-2026-0865 CVE-2025-8291 CVE-2013-0340 CVE-2025-6069 CVE-2026-6019 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - ELS-2237: apply 06004 (skip test_simple_xml_chunk_1/_5) on el7 too, not just rhel >= 8. el7's expat now carries the 2.6 reparse-deferral backport while still reporting an older version, so those version-gated tests fail in %check as they already did on el8/el9. Critical TuxCare License Agreement CVE-2025-13836 CVE-2026-6100 CVE-2025-4516 CVE-2025-8194 CVE-2025-4435 CVE-2025-15282 CVE-2025-13462 CVE-2026-1502 CVE-2024-12718 CVE-2025-15366 CVE-2025-12084 CVE-2025-15367 CVE-2026-1299 CVE-2025-4138 CVE-2026-3644 CVE-2025-13837 CVE-2026-4519 CVE-2025-4330 CVE-2024-9287 CVE-2026-9669 CVE-2024-11168 CVE-2026-8328 CVE-2026-3446 CVE-2026-0865 CVE-2025-4517 CVE-2026-4224 CVE-2026-0672 CVE-2025-8291 CVE-2025-6069 CVE-2025-1795 CVE-2025-0938 CVE-2026-6019 CVE-2025-6075 CVE-2026-7210 CVE-2025-11468 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-9669: bz2.BZ2Decompressor records the libbz2 error code after a decompression failure and refuses any subsequent decompress() call with ValueError, instead of re-entering BZ2_bzDecompress() on an inconsistent bz_stream which could cause a stack buffer overflow (CWE-121). Critical TuxCare License Agreement CVE-2026-6100 CVE-2025-8194 CVE-2025-15282 CVE-2025-13462 CVE-2026-1502 CVE-2025-15366 CVE-2025-12084 CVE-2025-15367 CVE-2026-1299 CVE-2026-3644 CVE-2025-13837 CVE-2026-4519 CVE-2026-9669 CVE-2026-3446 CVE-2026-0865 CVE-2026-4224 CVE-2026-0672 CVE-2025-8291 CVE-2025-6069 CVE-2025-1795 CVE-2026-6019 CVE-2025-6075 CVE-2026-7210 CVE-2025-11468 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - ALTPYTH-592: Update to 3.10.20 version Moderate TuxCare License Agreement CVE-2024-6923 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - ALTPYTH-591: Update to 3.11.15 version Moderate TuxCare License Agreement CVE-2024-6923 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2022-40897: regex denial of service via crafted HTML in package_index - CVE-2024-6345: remote code execution via command injection in VCS download functions - CVE-2025-47273: path traversal in PackageIndex download filename resolution Important TuxCare License Agreement CVE-2025-47273 CVE-2022-40897 CVE-2024-6345 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-15308: fix quadratic-complexity CPU denial-of-service in incremental HTML parsing (Lib/HTMLParser.py). feed() previously concatenated new data onto the unparsed buffer and re-scanned it from the start on every call, so feeding an unterminated construct in many small chunks was quadratic. New data is now accumulated in a list and only joined and parsed once enough has piled up, with close() flushing the pending buffer. Port of gh-153030 (GH-153031). Important TuxCare License Agreement CVE-2026-15308 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-15366: reject control characters in imaplib IMAP4 commands - CVE-2025-15367: reject control characters in poplib POP3 commands - CVE-2026-3644: reject control characters in http.cookies Morsel.update(), |=, unpickling and js_output - CVE-2026-4224: add recursion guard to pyexpat conv_content_model() to prevent C stack overflow - CVE-2026-4519: reject webbrowser URLs with a leading dash to prevent argument injection Important TuxCare License Agreement CVE-2025-15366 CVE-2025-15367 CVE-2026-3644 CVE-2026-4519 CVE-2026-4224 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - el10: build _decimal against system libmpdec (BuildRequires mpdecimal-devel, configure --with-system-libmpdec, patch setup.py to link -lmpdec since el10 ships libmpdec.so.3 not .so.2, and _decimal.c uchar->unsigned char for the mpdecimal 2.5 api); the bundled libmpdec fails to compile with -Og under the el10 gcc, which broke the CL10 build - el10: apply 06003 (BIO_eof ASN1 EOF, CPython gh-100372) so test_ssl cadata tests pass with OpenSSL 3.5.x, matching the alpine build (ALTPYTH-611) Important TuxCare License Agreement CVE-2026-15308 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-15308: html.parser.HTMLParser incremental parsing was quadratic when an unterminated construct (tag or comment) spanned many feed() calls, because the growing buffer was rescanned and concatenated on every call -- a CPU denial-of-service on attacker-controlled input. New data is now accumulated in a list and only joined and parsed once enough has piled up; close() flushes any buffered data before the final parse. Important TuxCare License Agreement CVE-2026-15308 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-15308: html.parser.HTMLParser had quadratic complexity when an unterminated construct (tag, comment, declaration) was fed across many feed() calls, since each call rescanned the growing buffer and reconcatenated onto it, allowing a CPU denial-of-service on uncontrolled data. feed() now accumulates new data in a list and only joins and parses it once enough has piled up, flushing the buffer in close() (upstream gh-153030 / bcf98ddb, adapted to 3.6: identical feed()/close()/reset() logic, test added with "from test import support", NEWS.d fragment omitted). Important TuxCare License Agreement CVE-2026-15308 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-4786: reject action-token-expanded dash-prefixed args in webbrowser.open() (CVE-2026-4519 bypass) - CVE-2026-6100: fix dangling next_in pointer (UAF) in bz2/lzma decompressors after MemoryError on reuse - CVE-2026-7210: use XML_SetHashSalt16Bytes 16-byte entropy for Expat hash-flooding protection when available - CVE-2026-41080: backport libexpat XML_SetHashSalt16Bytes into the bundled expat (ubuntu16.04 / el7; other platforms link system expat) so the CVE-2026-7210 16-byte salt path is not inert - CVE-2026-9669: prevent bz2.BZ2Decompressor reuse after a decompression error (stack buffer overflow) Critical TuxCare License Agreement CVE-2026-6100 CVE-2025-15366 CVE-2025-15367 CVE-2026-3644 CVE-2026-4519 CVE-2026-9669 CVE-2026-4786 CVE-2026-4224 CVE-2026-7210 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-4786: fix action-substitution bypass of the CVE-2026-4519 webbrowser dash-prefix check - CVE-2026-6100: clear decompressor next_in on the error path in bz2/lzma to prevent use-after-free - CVE-2026-7210: use XML_SetHashSalt16Bytes for 16-byte Expat hash-flooding entropy - CVE-2026-41080: backport libexpat XML_SetHashSalt16Bytes into the bundled expat (Debian/Ubuntu, el7) so the CVE-2026-7210 16-byte salt path is not inert - CVE-2026-9669: refuse bz2 decompressor reuse after a previous error to prevent stack buffer overflow Critical TuxCare License Agreement CVE-2026-6100 CVE-2026-9669 CVE-2026-4786 CVE-2026-7210 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-15308: fix quadratic-complexity CPU DoS in html.parser.HTMLParser incremental parsing of long unterminated constructs Important TuxCare License Agreement CVE-2026-15308 cpe:/o:centos:centos:7 alt-python36 alt-python36-debug alt-python36-devel alt-python36-libs alt-python36-test alt-python36-tkinter alt-python36-tools alt-python27 alt-python27-debug alt-python27-devel alt-python27-libs alt-python27-test alt-python27-tkinter alt-python27-tools alt-python38 alt-python38-debug alt-python38-devel alt-python38-idle alt-python38-libs alt-python38-test alt-python38-tkinter alt-python39 alt-python39-debug alt-python39-devel alt-python39-idle alt-python39-libs alt-python39-test alt-python39-tkinter alt-python310 alt-python310-debug alt-python310-devel alt-python310-idle alt-python310-libs alt-python310-test alt-python310-tkinter alt-python311 alt-python311-debug alt-python311-devel alt-python311-idle alt-python311-libs alt-python311-test alt-python311-tkinter alt-python38-setuptools alt-python38-setuptools-wheel x86_64 0:3.6.15-6.el7 d07bf2a08d50eb66 x86_64 0:3.6.15-7.el7 x86_64 0:3.6.15-8.el7 x86_64 0:2.7.18-14.el7 x86_64 0:2.7.18-16.el7 x86_64 0:2.7.18-20.el7 x86_64 0:2.7.18-21.el7 x86_64 0:3.6.15-13.el7 x86_64 0:3.6.15-16.el7 x86_64 0:2.7.18-22.el7 x86_64 0:3.6.15-17.el7 x86_64 0:2.7.18-23.el7 x86_64 0:3.6.15-18.el7 x86_64 0:3.6.15-19.el7 x86_64 0:2.7.18-24.el7 x86_64 0:2.7.18-25.el7 x86_64 0:3.6.15-20.el7 x86_64 0:2.7.18-27.el7 x86_64 0:3.6.15-21.el7 x86_64 0:2.7.18-29.el7 x86_64 0:2.7.18-30.el7 x86_64 0:3.6.15-22.el7 x86_64 0:3.6.15-23.el7 x86_64 0:2.7.18-31.el7 x86_64 0:3.6.15-24.el7 x86_64 0:2.7.18-32.el7 x86_64 0:3.6.15-25.el7 x86_64 0:3.6.15-28.el7 x86_64 0:2.7.18-34.el7 x86_64 0:3.6.15-29.el7 x86_64 0:3.6.15-30.el7 x86_64 0:2.7.18-35.el7 x86_64 0:2.7.18-37.el7 x86_64 0:3.8.20-19.el7 x86_64 0:3.9.23-17.el7 x86_64 0:3.10.20-1.el7 x86_64 0:3.11.15-1.el7 0:58.3.0-3.el7 x86_64 0:2.7.18-38.el7 x86_64 0:3.10.20-2.el7 x86_64 0:3.9.23-19.el7 x86_64 0:3.8.20-20.el7 x86_64 0:3.6.15-31.el7 x86_64 0:3.11.15-3.el7 x86_64 0:3.10.20-3.el7 x86_64 0:3.10.20-4.el7