Red Hat Product Errata RHSA-2026:10102 - Security Advisory Issued: 2026-04-23 Updated: 2026-04-23 RHSA-2026:10102 - Security Advisory Overview Updated Packages Synopsis Important: python security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for python is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64 Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386 Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x Fixes BZ - 2449649 - CVE-2026-4519 python: Python: Command-line option injection in webbrowser.open() via crafted URLs CVEs CVE-2026-4519 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 SRPM python-2.6.6-70.el6_10.3.src.rpm SHA-256: 2798a51246067535eed31cefaaf141d74450c58037a45cc349fa28ea63958013 x86_64 python-2.6.6-70.el6_10.3.x86_64.rpm SHA-256: 76b650888357eb606692e06681e3d7e662d359cee17ae4e123df9c9fbdae8b70 python-debuginfo-2.6.6-70.el6_10.3.i686.rpm SHA-256: d083556ae5a98d5ddaaa890d043303fab54878a0080faece6e041afe3ffc5c38 python-debuginfo-2.6.6-70.el6_10.3.x86_64.rpm SHA-256: fc767a8f3850c284f62fdfb7df2466fbc1843c7217c144494f760cf31c43f2cd python-debuginfo-2.6.6-70.el6_10.3.x86_64.rpm SHA-256: fc767a8f3850c284f62fdfb7df2466fbc1843c7217c144494f760cf31c43f2cd python-devel-2.6.6-70.el6_10.3.i686.rpm SHA-256: fdeb8cd72ea498899b7c467045cefee677610dd44b40df3e943e344a0784b286 python-devel-2.6.6-70.el6_10.3.x86_64.rpm SHA-256: f69d5fba5ea359532fcc1430b681b8eef3a21dcfdcc15ec2f67fa02deb764135 python-libs-2.6.6-70.el6_10.3.i686.rpm SHA-256: ba4dff874f5302851b3a57e3141b33623b8ee543d45246ca698be7582be304b4 python-libs-2.6.6-70.el6_10.3.x86_64.rpm SHA-256: f4c580b119993a2e9da636bb5dc2d2c86806f85406ea19061fce66c4d6bc0156 python-test-2.6.6-70.el6_10.3.x86_64.rpm SHA-256: 07c598059c947f0e311849a75b197755b6a94795fbb5767a16ce139e9e053e36 python-tools-2.6.6-70.el6_10.3.x86_64.rpm SHA-256: b3eb6f6cf159905d7886f38f161a4a847db710f432ffb2f7827d28fd4f2855c1 tkinter-2.6.6-70.el6_10.3.x86_64.rpm SHA-256: 68d550d4620b597ff92b22e4a5b332c41d0daafee136e62cf62e250c4ae5d5da i386 python-2.6.6-70.el6_10.3.i686.rpm SHA-256: f8d42ae04a3c4bdc0d7cb5d0ca057815432d6d64304cfa2a4aa043d7b92e23e3 python-debuginfo-2.6.6-70.el6_10.3.i686.rpm SHA-256: d083556ae5a98d5ddaaa890d043303fab54878a0080faece6e041afe3ffc5c38 python-debuginfo-2.6.6-70.el6_10.3.i686.rpm SHA-256: d083556ae5a98d5ddaaa890d043303fab54878a0080faece6e041afe3ffc5c38 python-devel-2.6.6-70.el6_10.3.i686.rpm SHA-256: fdeb8cd72ea498899b7c467045cefee677610dd44b40df3e943e344a0784b286 python-libs-2.6.6-70.el6_10.3.i686.rpm SHA-256: ba4dff874f5302851b3a57e3141b33623b8ee543d45246ca698be7582be304b4 python-test-2.6.6-70.el6_10.3.i686.rpm SHA-256: f9fcfa8eb3d7b69246f6bb6840f16a19b2ce0510fe87ffba5e98f1d23b4beca4 python-tools-2.6.6-70.el6_10.3.i686.rpm SHA-256: 4739b7920a3b61aea9354bdeb7d42d8ffe90811d6543957d21c3b614da4b47bc tkinter-2.6.6-70.el6_10.3.i686.rpm SHA-256: 649b087d9330e8b21bfff00662dfe67b7fc41a2f0554b5836636fd2e2ac72e9e Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 SRPM python-2.6.6-70.el6_10.3.src.rpm SHA-256: 2798a51246067535eed31cefaaf141d74450c58037a45cc349fa28ea63958013 s390x python-2.6.6-70.el6_10.3.s390x.rpm SHA-256: 59fd3a762cda8427f6ebcee21d44d4304d231f428dcec783b7549568558f7cc6 python-debuginfo-2.6.6-70.el6_10.3.s390.rpm SHA-256: bd36db598eb05f2d24ddba26613ddaa9e6a931057377123a18c66c5f38a35b8c python-debuginfo-2.6.6-70.el6_10.3.s390x.rpm SHA-256: 6554de13d7a04a0bae4e6d0d3a6ac0d2d76f028b01add921ec8d17398c6bebca python-debuginfo-2.6.6-70.el6_10.3.s390x.rpm SHA-256: 6554de13d7a04a0bae4e6d0d3a6ac0d2d76f028b01add921ec8d17398c6bebca python-devel-2.6.6-70.el6_10.3.s390.rpm SHA-256: 70531e21f062715cdf7ce693bf6a3459dd2dbfb015d80041eb3984f9d5c2dc07 python-devel-2.6.6-70.el6_10.3.s390x.rpm SHA-256: 2f0b8f82f86b7fa9839fb7740a7ef53aef30ccba3a07658b637f7c65956c342c python-libs-2.6.6-70.el6_10.3.s390.rpm SHA-256: dadfc3e924d9d8809c823907989988312f9a4e763c351a62c1318ccd5568bd2b python-libs-2.6.6-70.el6_10.3.s390x.rpm SHA-256: a22d150aa8c12b8e33c0e15323899d3109c5560442c1940848622dd1023e8b50 python-test-2.6.6-70.el6_10.3.s390x.rpm SHA-256: e2356a46ca86b24c055469af54eb5c521741b24d8625421ac007e29ddc1b71ef python-tools-2.6.6-70.el6_10.3.s390x.rpm SHA-256: 440f4c6a38a29656333fbf6f51c9108a44fe33c02288a6fdcc96ff206c719ce4 tkinter-2.6.6-70.el6_10.3.s390x.rpm SHA-256: 75efae4a497aa8bad2a85631c1c67254ec2274a0730bcfd8c0a959fdb390384e The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .
This vulnerability (CVE-2026-4519, CVSS 3.3 LOW) is a command-line option injection in Python's `webbrowser.open()` function that can be triggered via crafted URLs. According to NVD data, Python versions 3.13.x prior to 3.13.13, versions 3.14.x prior to 3.14.4, and version 3.15.0 are affected. The fix requires upgrading to Python 3.13.13, 3.14.4, or a subsequent version that addresses the flaw.