CPython: Mehrere Schwachstellen
WID-SEC-2026-3716 · first 02.10.2026 · updated 28.10.2026 · CVSS 8,1
What it is about
Python ist eine universelle, üblicherweise interpretierte, höhere Programmiersprache. Ein Angreifer kann mehrere Schwachstellen in Python ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- einen nicht näher spezifizierten Angriff durchzuführen
- einen Denial of Service Angriff durchzuführen
- Sicherheitsvorkehrungen zu umgehen
Am I affected?
Affected according to the BSI:
- Debian Linux
- Amazon Linux 2
- Red Hat Enterprise Linux
- IBM AIX
- RESF Rocky Linux
- SUSE Linux
- SUSE openSUSE
- Oracle Linux
- Open Source Python CPython
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Install the updates provided by the vendor; details in the sources below.
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- GitHub Advisory Databse vom 2026-10-01 github.com
- GitHub Advisory Databse vom 2026-10-01 github.com
- Python Security Announce vom 2026-10-01 mail.python.org
- Python Security Announce vom 2026-10-01 mail.python.org
- Red Hat Security Advisory RHSA-2026:74867 vom 2026-10-05 access.redhat.com
- Red Hat Security Advisory RHSA-2026:77028 vom 2026-10-07 access.redhat.com
- Red Hat Security Advisory RHSA-2026:77017 vom 2026-10-08 access.redhat.com
- Debian Security Advisory DLA-4827 vom 2026-10-08 lists.debian.org
- Rocky Linux Security Advisory RLSA-2026:77028 vom 2026-10-08 errata.build.resf.org
- Oracle Linux Security Advisory ELSA-2026-77028 vom 2026-10-08 linux.oracle.com
- Red Hat Security Advisory RHSA-2026:77018 vom 2026-10-08 access.redhat.com
- Oracle Linux Security Advisory ELSA-2026-77020 vom 2026-10-09 linux.oracle.com
- Oracle Linux Security Advisory ELSA-2026-77017 vom 2026-10-08 linux.oracle.com
- Red Hat Security Advisory RHSA-2026:77021 vom 2026-10-08 access.redhat.com
- Oracle Linux Security Advisory ELSA-2026-77021 vom 2026-10-09 linux.oracle.com
- Oracle Linux Security Advisory ELSA-2026-77018 vom 2026-10-08 linux.oracle.com
- Rocky Linux Security Advisory RLSA-2026:77018 vom 2026-10-09 errata.build.resf.org
- Rocky Linux Security Advisory RLSA-2026:77021 vom 2026-10-09 errata.build.resf.org
- Rocky Linux Security Advisory RLSA-2026:77020 vom 2026-10-09 errata.build.resf.org
- Rocky Linux Security Advisory RLSA-2026:77017 vom 2026-10-09 errata.build.resf.org
- SUSE Security Update SUSE-SU-2026:4630-1 vom 2026-10-12 lists.suse.com
- SUSE Security Update SUSE-SU-2026:4659-1 vom 2026-10-14 lists.suse.com
- Red Hat Security Advisory RHSA-2026:85239 vom 2026-10-19 access.redhat.com
- openSUSE Security Update OPENSUSE-SU-2026:12069-1 vom 2026-10-19 lists.opensuse.org
- IBM Security Bulletin 7293240 vom 2026-10-21 aix.software.ibm.com
and 15 more sources in the original advisory
CVE: CVE-2026-19445, CVE-2026-19553
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.