SUSE-SU-2026:3132-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2026:3132-1

HIGH8.1

Security update for python311

Published Jul 20, 2026

Modified 5 days ago

Fix available

Details

Description of the patch:

This update for python311 fixes the following issues

CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers or host (bsc#1261969).
CVE-2026-4786: URLs containing %action can bypass mitigation that allows command injection via the webbrowser.open() API (bsc#1262319).
CVE-2026-6019: HTML parser-sensitive sequence not neutralized by http.cookies.Morsel.js_output() (bsc#1262654).
CVE-2026-6100: use-after-free in decompression modules when a memory allocation fails with a MemoryError and the decompression instance is re-used (bsc#1262098).

Affected Packages(11 packages)

libpython3_11-1_0

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

Fixed in:

3.11.15-150400.9.91.1

python311

Fixed in:

3.11.15-150400.9.91.1

python311-base

Fixed in:

3.11.15-150400.9.91.1

python311-curses

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

Fixed in:

3.11.15-150400.9.91.1

python311-dbm

Fixed in:

3.11.15-150400.9.91.1

python311-devel

Fixed in:

3.11.15-150400.9.91.1

python311-doc

Fixed in:

3.11.15-150400.9.91.1

python311-doc-devhelp