<div class="container">
<h1>Security update for python311</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:23743-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-09-16T09:53:12Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259240">bsc#1259240</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259611">bsc#1259611</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259734">bsc#1259734</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259735">bsc#1259735</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1260026">bsc#1260026</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1261969">bsc#1261969</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1262098">bsc#1262098</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1262319">bsc#1262319</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1264962">bsc#1264962</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265268">bsc#1265268</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267581">bsc#1267581</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267821">bsc#1267821</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267974">bsc#1267974</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268977">bsc#1268977</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1269066">bsc#1269066</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1269788">bsc#1269788</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1269959">bsc#1269959</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271192">bsc#1271192</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1276223">bsc#1276223</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1276226">bsc#1276226</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2021-4189.html">CVE-2021-4189</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-13462.html">CVE-2025-13462</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-4330.html">CVE-2025-4330</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-0864.html">CVE-2026-0864</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-11940.html">CVE-2026-11940</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-11972.html">CVE-2026-11972</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-1502.html">CVE-2026-1502</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-15308.html">CVE-2026-15308</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-15806.html">CVE-2026-15806</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-17084.html">CVE-2026-17084</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-2297.html">CVE-2026-2297</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-3276.html">CVE-2026-3276</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-3644.html">CVE-2026-3644</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-4224.html">CVE-2026-4224</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-4360.html">CVE-2026-4360</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-45186.html">CVE-2026-45186</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-4519.html">CVE-2026-4519</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-4786.html">CVE-2026-4786</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-6100.html">CVE-2026-6100</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-7210.html">CVE-2026-7210</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-72522.html">CVE-2026-72522</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-7774.html">CVE-2026-7774</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-8328.html">CVE-2026-8328</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-9669.html">CVE-2026-9669</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2021-4189</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2021-4189</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2021-4189</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-13462</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.0</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-13462</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-13462</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">2.0</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-13462</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.3</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-4330</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-4330</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-0864</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-0864</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-0864</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.1</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-0864</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-11940</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-11940</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-11940</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.8</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-11972</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-11972</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-11972</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-1502</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-1502</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-1502</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-15308</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-15308</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-15308</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-15308</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-15806</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-15806</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-15806</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-17084</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-17084</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-17084</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-2297</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.7</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-2297</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-2297</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.7</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3276</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3276</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3276</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3644</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3644</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3644</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3644</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4224</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4224</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4224</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4224</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4360</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.0</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4360</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4360</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">2.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4360</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-45186</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.9</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-45186</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">2.9</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-45186</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-45186</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4519</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4519</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4519</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.0</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4519</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4519</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.3</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4786</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.0</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4786</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4786</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.0</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4786</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-6100</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-6100</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-6100</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-6100</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-7210</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-7210</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-7210</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-7210</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-72522</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-72522</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-72522</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.2</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-7774</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-7774</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-7774</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-8328</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-8328</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-8328</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9669</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.7</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9669</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.7</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9669</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Micro 6.1</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves 24 vulnerabilities can now be installed.</p>
<h2>Description:</h2>
<p>This update for python311 fixes the following issues:</p>
<ul>
<li>CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).</li>
<li>CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
<code>configparser</code> module is used (bsc#1269066).</li>
<li>CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).</li>
<li>CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).</li>
<li>CVE-2026-3276: quadratic complexity in <code>unicodedata.normalize()</code> can lead to DoS when processing specially crafted
Unicode input (bsc#1267581).</li>
<li>CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).</li>
<li>CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).</li>
<li>CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting
hardlinks (bsc#1269959).</li>
<li>CVE-2026-4519: leading dashes in URLs are accepted by the <code>webbrowser.open()</code> API and allow for web browser command
line option injection (bsc#1260026).</li>
<li>CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319).</li>
<li>CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules
(bsc#1262098).</li>
<li>CVE-2026-7210: <code>xml.parsers.expat</code> and <code>xml.etree.ElementTree</code> use insufficient entropy for Expat hash-flooding
protection (bsc#1264962).</li>
<li>CVE-2026-7774: <code>tarfile.data_filter</code> path traversal bypass allows writing outside the extraction directory
(bsc#1267821).</li>
<li>CVE-2026-8328: <code>ftpcp()</code> does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).</li>
<li>CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).</li>
<li>CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and
enables arbitrary file reads and writes (bsc#1268977).</li>
<li>CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS
(bsc#1269788).</li>
<li>CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations
(bsc#1271192).</li>
<li>CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another
scheme (bsc#1276223).</li>
<li>CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).</li>
</ul>
<p>Changes for python311:</p>
<ul>
<li>Update to 3.11.16:</li>
<li>Build</li>
<li>gh-153438: Update Windows build and installer tooling and
documentation to use the current download URL for
nuget.exe.</li>
<li>Library</li>
<li>gh-109638: Fix exponential time in csv.Sniffer.sniff() for
a sample which contains many quote characters. A doubled
quote character is now also detected in a field which
contains the delimiter or a line break.</li>
<li>gh-98820: Fix quadratic time in csv.Sniffer.sniff() for
a sample which contains quoted fields, in particular for
a single column of quoted fields.</li>
<li>gh-149231: In tomllib, the number of parts in TOML keys is
now limited.</li>
<li>gh-146083: Update bundled libexpat to version 2.7.5.</li>
<li>gh-141707: Don't change tarfile.TarInfo type from AREGTYPE
to DIRTYPE when parsing GNU long name or link headers
(bsc#1259611, CVE-2025-13462).</li>
<li>gh-90949: Add
SetBillionLaughsAttackProtectionActivationThreshold() and
SetBillionLaughsAttackProtectionMaximumAmplification() to
xmlparser objects to tune protections against billion
laughs attacks. Patch by Bénédikt Tran.</li>
<li>gh-100372: ssl.SSLContext.load_verify_locations() no longer
incorrectly accepts some cases of trailing data when
parsing DER.</li>
<li>Security</li>
<li>gh-155558: Update bundled libexpat to version 2.8.3 for the
fix to CVE-2026-72522.</li>
<li>gh-153030: Fixed quadratic complexity in incremental
parsing of long unterminated constructs (such as tags or
comments) in html.parser.HTMLParser, which could be
exploited for a denial of service (bsc#1271192,
CVE-2026-15308).</li>
<li>gh-152674: The xml.etree.ElementTree.Element methods
findall(), iterfind() and find() avoid quadratic behavior
when using XPath index predicates ([1], [last()],
[last()-N]) on XML documents with many same-tag siblings.</li>
<li>gh-152216: Update bundled libexpat to version 2.8.2.</li>
<li>gh-151987: The tarfile.TarFile.extract() method now applies
the given filter when it extracts a link target from the
archive as a fallback (bsc#1269959, CVE-2026-4360).</li>
<li>gh-151981: In tarfile, seeking a stream now stops when end
of the stream is reached (bsc#1269788, CVE-2026-11972).</li>
<li>gh-151544: Modules/Setup.local is no longer used as
a landmark to discover whether Python is running in
a source tree, as it could potentially affect actual
installs. The pybuilddir.txt file is now the sole indicator
of running in a source tree.</li>
<li>gh-151558: Fixed an vulnerability in the tarfile data and
tar extraction filters where crafted archives could create
a symlink pointing outside the destination directory. This
was a bypass of CVE-2025-4330 (bsc#1268977,
CVE-2026-11940).</li>
<li>gh-150599: Fix a possible stack buffer overflow in bz2 when
a bz2.BZ2Decompressor is reused after a decompression
error. The decompressor now becomes unusable after libbz2
reports an error (bsc#1267974, CVE-2026-9669).</li>
<li>gh-150743: http.client now limits the number of
chunked-response trailer lines it will read to 100, and the
number of interim (1xx) responses it will skip to 100.
A malicious or broken server could previously stream
trailer lines or 100 Continue responses forever, hanging
the client even when a socket timeout was in use. Reported
by @YLChen-007 via GHSA-w4q2-g22w-6fr4.</li>
<li>gh-149698: Update bundled libexpat to version 2.8.1 for the
fix for CVE-2026-45186.</li>
<li>gh-87451: The ftplib module's undocumented ftpcp function
no longer trusts the IPv4 address value returned from the
source server in response to the PASV command by default,
completing the fix for CVE-2021-4189. As with ftplib.FTP,
the former behavior can be re-enabled by setting the
trust_server_pasv_ipv4_address attribute on the source
ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
AI for the report (bsc#1265268, CVE-2026-8328).</li>
<li>gh-149486: tarfile.data_filter() now validates link targets
using the same normalised value that is written to disk,
strips trailing separators from the member name when
resolving a symlink's directory, and rejects link members
that would replace the destination directory itself. This
closes several path-traversal bypasses of the data
extraction filter (bsc#1267821, CVE-2026-7774).</li>
<li>gh-149079: Fix a potential denial of service in
unicodedata.normalize(). The canonical ordering step of
Unicode normalization used a quadratic-time insertion sort
for reordering combining characters, which could be
exploited with crafted input containing many combining
characters in non-canonical order. Replaced with
a linear-time counting sort for long runs (bsc#1267581,
CVE-2026-3276).</li>
<li>gh-149018: Improved protection against XML hash-flooding
attacks in xml.parsers.expat and xml.etree.ElementTree when
Python is compiled with libExpat 2.8.0 or later
(bsc#1264962, CVE-2026-7210).</li>
<li>gh-149017: Update bundled libexpat to version 2.8.0.</li>
<li>gh-148808: Added buffer boundary check when using nbytes
parameter with
asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
relevant for Windows and the asyncio.ProactorEventLoop.</li>
<li>gh-148395: Fix a dangling input pointer in
lzma.LZMADecompressor, and bz2.BZ2Decompressor when memory
allocation fails with MemoryError, which could let
a subsequent decompress() call read or write through
a stale pointer to the already-released caller buffer
(bsc#1262098, CVE-2026-6100).</li>
<li>gh-148169: A bypass in webbrowser allowed URLs prefixed
with %action to pass the dash-prefix safety check
(bsc#1262319, CVE-2026-4786).</li>
<li>gh-146581: Fix vulnerability in shutil.unpack_archive() for
ZIP files on Windows which allowed to write files outside
of the destination tree if the patch in the archive
contains a Windows drive prefix. Now such invalid paths
will be skipped. Files containing ".." in the name (like
"foo..bar") are no longer skipped.</li>
<li>gh-146333: Fix quadratic backtracking in
configparser.RawConfigParser option parsing regexes (OPTCRE
and OPTCRE_NV). A crafted configuration line with many
whitespace characters could cause excessive CPU usage.</li>
<li>gh-146211: Reject CR/LF characters in tunnel request
headers for the HTTPConnection.set_tunnel() method
(bsc#1261969, CVE-2026-1502).</li>
<li>gh-145986: xml.parsers.expat: Fixed a crash caused by
unbounded C recursion when converting deeply nested XML
content models with ElementDeclHandler(). This addresses
CVE-2026-4224 (bsc#1259735, CVE-2026-4224).</li>
<li>gh-145599: Reject control characters in http.cookies.Morsel
update() and js_output(). This addresses CVE-2026-3644
(bsc#1259734, CVE-2026-3644).</li>
<li>gh-145506: Fixes CVE-2026-2297 by ensuring that
SourcelessFileLoader uses io.open_code() when opening .pyc
files (bsc#1259240, CVE-2026-2297).</li>
<li>gh-144370: Disallow usage of control characters in status
in wsgiref.handlers to prevent HTTP header injections.
Patch by Benedikt Johannes.</li>
<li>gh-143930: Reject leading dashes in URLs passed to
webbrowser.open() (bsc#1260026, CVE-2026-4519).</li>
<li>gh-143927: Normalize all line endings (CR, CRLF, and LF) to
LF+TAB when writing multi-line configparser values
(bsc#1269066, CVE-2026-0864).</li>
<li>Tests</li>
<li>gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
skip UDP Lite tests if it's not supported. Patch by Victor
Stinner.</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Micro 6.1
<br/>
<code>zypper in -t patch SUSE-SLE-Micro-6.1-733</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Micro 6.1 (aarch64 ppc64le s390x x86_64)
<ul>
<li>python311-debuginfo-3.11.16-slfo.1.1_1.1</li>
<li>libpython3_11-1_0-debuginfo-3.11.16-slfo.1.1_1.1</li>
<li>python311-core-debugsource-3.11.16-slfo.1.1_1.1</li>
<li>python311-curses-3.11.16-slfo.1.1_1.1</li>
<li>python311-base-3.11.16-slfo.1.1_1.1</li>
<li>python311-base-debuginfo-3.11.16-slfo.1.1_1.1</li>
<li>libpython3_11-1_0-3.11.16-slfo.1.1_1.1</li>
<li>python311-curses-debuginfo-3.11.16-slfo.1.1_1.1</li>
<li>python311-debugsource-3.11.16-slfo.1.1_1.1</li>
<li>python311-3.11.16-slfo.1.1_1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2021-4189.html">https://www.suse.com/security/cve/CVE-2021-4189.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-13462.html">https://www.suse.com/security/cve/CVE-2025-13462.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-4330.html">https://www.suse.com/security/cve/CVE-2025-4330.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-0864.html">https://www.suse.com/security/cve/CVE-2026-0864.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-11940.html">https://www.suse.com/security/cve/CVE-2026-11940.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-11972.html">https://www.suse.com/security/cve/CVE-2026-11972.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-1502.html">https://www.suse.com/security/cve/CVE-2026-1502.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-15308.html">https://www.suse.com/security/cve/CVE-2026-15308.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-15806.html">https://www.suse.com/security/cve/CVE-2026-15806.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-17084.html">https://www.suse.com/security/cve/CVE-2026-17084.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-2297.html">https://www.suse.com/security/cve/CVE-2026-2297.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-3276.html">https://www.suse.com/security/cve/CVE-2026-3276.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-3644.html">https://www.suse.com/security/cve/CVE-2026-3644.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-4224.html">https://www.suse.com/security/cve/CVE-2026-4224.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-4360.html">https://www.suse.com/security/cve/CVE-2026-4360.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-45186.html">https://www.suse.com/security/cve/CVE-2026-45186.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-4519.html">https://www.suse.com/security/cve/CVE-2026-4519.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-4786.html">https://www.suse.com/security/cve/CVE-2026-4786.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-6100.html">https://www.suse.com/security/cve/CVE-2026-6100.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-7210.html">https://www.suse.com/security/cve/CVE-2026-7210.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-72522.html">https://www.suse.com/security/cve/CVE-2026-72522.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-7774.html">https://www.suse.com/security/cve/CVE-2026-7774.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-8328.html">https://www.suse.com/security/cve/CVE-2026-8328.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-9669.html">https://www.suse.com/security/cve/CVE-2026-9669.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259240">https://bugzilla.suse.com/show_bug.cgi?id=1259240</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259611">https://bugzilla.suse.com/show_bug.cgi?id=1259611</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259734">https://bugzilla.suse.com/show_bug.cgi?id=1259734</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259735">https://bugzilla.suse.com/show_bug.cgi?id=1259735</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1260026">https://bugzilla.suse.com/show_bug.cgi?id=1260026</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1261969">https://bugzilla.suse.com/show_bug.cgi?id=1261969</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1262098">https://bugzilla.suse.com/show_bug.cgi?id=1262098</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1262319">https://bugzilla.suse.com/show_bug.cgi?id=1262319</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1264962">https://bugzilla.suse.com/show_bug.cgi?id=1264962</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265268">https://bugzilla.suse.com/show_bug.cgi?id=1265268</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267581">https://bugzilla.suse.com/show_bug.cgi?id=1267581</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267821">https://bugzilla.suse.com/show_bug.cgi?id=1267821</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267974">https://bugzilla.suse.com/show_bug.cgi?id=1267974</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268977">https://bugzilla.suse.com/show_bug.cgi?id=1268977</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1269066">https://bugzilla.suse.com/show_bug.cgi?id=1269066</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1269788">https://bugzilla.suse.com/show_bug.cgi?id=1269788</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1269959">https://bugzilla.suse.com/show_bug.cgi?id=1269959</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271192">https://bugzilla.suse.com/show_bug.cgi?id=1271192</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1276223">https://bugzilla.suse.com/show_bug.cgi?id=1276223</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1276226">https://bugzilla.suse.com/show_bug.cgi?id=1276226</a>
</li>
</ul>
</div>