Loading story…
Red Hat released Important security updates for python3.12 and python3.14 across RHEL 8, 9, and 10 to address CVE-2026-11940, a CPython tarfile extraction filter bypass that can let files escape the intended extraction directory. The flaw is a form of path traversal mapped to CWE-22, where specially crafted archive entries can write outside a restricted destination and potentially enable unauthorized file overwrite, file creation, or broader system impact. Updated packages include python3.12-3.12.14-1.el8_10, python3.12-3.12.14-1.el9_8, python3.12.14-1.el10_2, and python3.14.7-2.el10_2 for multiple architectures and channels.
The remediation has also propagated into downstream enterprise Linux ecosystems. Nessus plugin coverage shows Rocky Linux 9 and AlmaLinux 8 advisories tracking the same vulnerability through RLSA-2026:59009 and ALSA-2026:58971, respectively, affecting multiple Python 3.12 package variants such as libraries, development files, and related components. The scanner entries note the vulnerability was published on 2026-06-23 and report no known public exploits, but organizations running Python archive extraction workflows on affected Red Hat-derived systems are being directed to deploy the vendor package updates.
See affected versions and whether adversaries are exploiting it.
21 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:63024 for RHEL 10, updating affected python3.12 and related Python packages to remediate CVE-2026-11940. The Important-rated advisory was published on September 3, 2026; the notice reported no known exploits.
Red Hat published RHSA-2026:62809 for RHEL 9 to remediate CVE-2026-11940 in affected python3.12 packages, including development, library, and Tkinter components. The Important-rated advisory was published on September 2, 2026; no known exploits were available.
Miracle Linux published advisory AXSA-2026-1673 for Miracle Linux 9, updating Python 3.14 standard and free-threading package variants to remediate CVE-2026-11940. The advisory covered runtime, debug, development, IDLE, library, test, and Tkinter packages and reported no known exploits.
Miracle Linux published advisory AXSA-2026-1655 for Miracle Linux 8, updating affected Python 3.12 runtime, development, debugging, IDLE, Tkinter, test, and related packages to remediate CVE-2026-11940. The Tenable plugin states that no known public exploits were available.
Miracle Linux published advisory AXSA-2026-1652 for Miracle Linux 8, updating affected platform-python and related Python 3 packages to remediate CVE-2026-11940. The plugin reported no known public exploits at publication.
Oracle Linux published ELSA-2026-59009 for Oracle Linux 9, updating affected Python 3.12 packages including debug, development, idle, libraries, test, and tkinter variants to remediate CVE-2026-11940. The plugin reported no known public exploits.
Oracle Linux published ELSA-2026-58901 for Oracle Linux 9, updating Python 3.14 and related standard and free-threading package variants to remediate CVE-2026-11940. The advisory stated that no known exploits were available.
Rocky Linux published RLSA-2026-58902 for Rocky Linux 10, updating Python 3.12-related packages to remediate CVE-2026-11940. The advisory covers python3 and related libraries, development, debug, test, and tkinter packages; it reported no known exploits at publication.
Tenable's Rocky Linux plugin records patch publication for RLSA-2026-59009 affecting Rocky Linux 9 python3.12-related packages for CVE-2026-11940. The plugin also states that no known exploits were available.
AlmaLinux published ALSA-2026:59009 to remediate CVE-2026-11940 in AlmaLinux 9 Python 3.12 packages across affected repositories. The Tenable plugin records the patch publication date as 2026-08-24 and states that no known public exploits were available.
Oracle Linux published ELSA-2026-58971 for Oracle Linux 8, updating affected Python 3.12 package variants to remediate CVE-2026-11940. The Tenable plugin states that no known exploits were available.
Tenable's AlmaLinux plugin records patch publication for ALSA-2026:58971, covering AlmaLinux 8 Python 3.12 packages affected by CVE-2026-11940. The plugin notes no known exploits were available at that time.
Red Hat published RHSA-2026:59009 for RHEL 9, making updated python3.12 packages version 3.12.14-1.el9_8 available to remediate CVE-2026-11940. The Important-rated advisory covered multiple architectures and related extended support channels.
Red Hat published RHSA-2026:58928 for RHEL 10, releasing python3.14 packages version 3.14.7-2.el10_2 for CVE-2026-11940. The advisory marked the issue Important and covered standard and CodeReady Linux Builder channels across several architectures.
Red Hat published RHSA-2026:58902 for RHEL 10, providing python3.12 version 3.12.14-1.el10_2 to fix CVE-2026-11940. The Important-rated update applied across multiple architectures and extended support channels.
Red Hat published RHSA-2026:58971 for RHEL 8, releasing updated python3.12 packages version 3.12.14-1.el8_10 to address CVE-2026-11940. The Important-rated update covered multiple architectures and related CodeReady Linux Builder and Extended Life Cycle channels.
Tencent published TSSA-2026:0914 for TencentOS Server 3 to remediate CVE-2026-11940. Tenable records the patch as published on August 18, 2026, and states that no known exploits were available.
Fedora published advisory FEDORA-2026-7de2b1cfc5 for Fedora 43 python3.12 packages, addressing CVE-2026-11940 alongside CVE-2026-3276 and CVE-2026-7210. The notice reported no known exploits for CVE-2026-11940.
Tenable's AlmaLinux plugin records patch publication for ALSA-2026:58902, covering AlmaLinux 10 Python 3.12-related packages affected by CVE-2026-11940. The plugin notes the patch was published on 2026-08-24 and that no known exploits were available.
The vulnerability CVE-2026-11940 was published as a CPython tarfile extraction filter bypass that can let files escape the intended extraction directory. Tenable plugin metadata ties the issue to CWE-22 path traversal.
Red Hat's Bug 2491848 record states that CVE-2026-11940 was addressed for Red Hat Enterprise Linux 9 through advisory RHSA-2026:58901. The record describes the flaw as an incomplete fix for CVE-2025-4330 affecting CPython tarfile extraction filters.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
22 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** libarchive security updates for affected RHEL 7 ELS, RHEL 8, and RHEL 9 releases and subscription channels, including OpenShift Container Platform and RHEL-based middleware containers. The updates remediate `CVE-2026-4424`, a heap out-of-bounds read in RAR processing: a crafted archive can exploit an LZSS dictionary-size validation error after PPMd-to-LZSS transitions to expose heap memory through `archive_read_data()` before CRC validation. Systems that automatically process untrusted archives may be remotely triggerable without authentication or user interaction. The releases also fix `CVE-2026-5121`, an ISO9660 zisofs parsing integer overflow that can allocate an undersized buffer and copy attacker-controlled data beyond its bounds. The resulting heap overflow can potentially enable arbitrary code execution on **32-bit** targets, subject to allocator- and platform-specific heap grooming; 64-bit systems do not exhibit the same integer wraparound. Organizations should update libarchive and associated `bsdtar`, `bsdcat`, and `bsdcpio` packages using the applicable Red Hat advisory—for example, RHEL 9 packages `3.5.3-9.el9_7`, RHEL 8 packages `3.3.3-7.el8_10`, and RHEL 7 ELS packages `3.1.2-14.el7_9.2`—or later supported versions.
Aug 25, 2026
Red Hat released Important-rated security updates for `urllib3` across Red Hat Enterprise Linux 8, 9, and 10 to remediate `CVE-2026-44432` and `CVE-2026-44431`. The more severe issue, `CVE-2026-44432`, is a denial-of-service flaw in the Python HTTP client library that can let a remote attacker force excessive CPU and memory consumption when `urllib3` fully decompresses an HTTP response even though only a partial read was requested, or when it drains a connection after partial decompression. Red Hat assigned the bug a CVSS v3 score of 7.5 and mapped it to `CWE-409`. The advisories cover multiple package streams and architectures, including `python-urllib3` for RHEL 10, `python3.14-urllib3` for RHEL 9 and 10, and `python3.12-urllib3` for RHEL 8 and 9, with fixes delivered in versions such as `1.26.19-4.el10_2`, `2.6.3-2.el10_2`, `2.6.3-2.el9_8`, `1.26.19-3.el9_8`, and `1.26.19-3.el8_10`. Red Hat said the same updates also address `CVE-2026-44431`, an information disclosure flaw in which sensitive headers may be forwarded across origins during redirects, and listed affected offerings including Extended Update Support, Extended Life Cycle releases, and Red Hat Ansible Automation Platform 2.5 and 2.6 as fixed.
Aug 27, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026