python312-core (SUSE:Linux Enterprise Server 15 SP6-LTSS) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server 15 SP6-LTSS package python312-core, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (11)

CVE-2026-4224 — CVSS 7.5 (high): When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content…
CVE-2026-3644 — CVSS 7.5 (high): The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and…
CVE-2026-0672: When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects…
CVE-2025-15282: User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
CVE-2025-15366: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects…
CVE-2025-15367: The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands…
CVE-2026-0865: User-controlled header names and values containing newlines can allow injecting HTTP headers.
CVE-2025-11468: When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This…
CVE-2025-13462 — CVSS 3.3 (low): The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such…
CVE-2026-4519 — CVSS 3.3 (low): The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers…
CVE-2026-3479: DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as…