tag:github.com,2008:https://github.com/fedora-python/cpython/releases Release notes from cpython 2026-02-10T13:52:50Z tag:github.com,2008:Repository/179495155/fedora-3.9.25-6 2026-02-10T13:52:50Z fedora-3.9.25-6: 00476: CVE-2026-1299 <p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3839525499" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/144125" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/144125/hovercard" href="https://github.com/python/cpython/issues/144125">pythongh-144125</a>: email: verify headers are sound in BytesGenerator<br> (cherry picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413/hovercard" href="https://github.com/fedora-python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413"><tt>052e55e</tt></a>)</p> <p>Co-authored-by: Seth Michael Larson <a href="mailto:seth@python.org">seth@python.org</a><br> Co-authored-by: Denis Ledoux <a href="mailto:dle@odoo.com">dle@odoo.com</a><br> Co-authored-by: Denis Ledoux <a href="mailto:5822488+beledouxdenis@users.noreply.github.com">5822488+beledouxdenis@users.noreply.github.com</a><br> Co-authored-by: Petr Viktorin <a href="mailto:302922+encukou@users.noreply.github.com">302922+encukou@users.noreply.github.com</a><br> Co-authored-by: Bas Bloemsaat <a href="mailto:1586868+basbloemsaat@users.noreply.github.com">1586868+basbloemsaat@users.noreply.github.com</a></p> miss-islington tag:github.com,2008:Repository/179495155/fedora-3.14.3-1 2026-02-09T15:52:32Z fedora-3.14.3-1 <p>00477: Raise an error when importing stdlib modules compiled for a di…</p> encukou tag:github.com,2008:Repository/179495155/fedora-3.11.14-5 2026-02-09T08:50:21Z fedora-3.11.14-5: 00475: CVE-2025-15367 <p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3822983279" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/143923" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/143923/hovercard" href="https://github.com/python/cpython/issues/143923">pythongh-143923</a>: Reject control characters in POP3 commands</p> <p>(cherry-picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7/hovercard" href="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7"><tt>b234a2b</tt></a>)</p> sethmlarson tag:github.com,2008:Repository/179495155/fedora-3.10.19-4 2026-02-09T09:37:44Z fedora-3.10.19-4: 00475: CVE-2025-15367 <p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3822983279" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/143923" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/143923/hovercard" href="https://github.com/python/cpython/issues/143923">pythongh-143923</a>: Reject control characters in POP3 commands</p> <p>(cherry-picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7/hovercard" href="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7"><tt>b234a2b</tt></a>)</p> sethmlarson tag:github.com,2008:Repository/179495155/fedora-3.9.25-5 2026-02-09T10:10:14Z fedora-3.9.25-5: 00475: CVE-2025-15367 <p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3822983279" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/143923" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/143923/hovercard" href="https://github.com/python/cpython/issues/143923">pythongh-143923</a>: Reject control characters in POP3 commands</p> <p>(cherry-picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7/hovercard" href="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7"><tt>b234a2b</tt></a>)</p> sethmlarson tag:github.com,2008:Repository/179495155/fedora-3.13.12-1 2026-02-06T11:28:48Z fedora-3.13.12-1: 00475: CVE-2025-15367 <p>Reject control characters in POP3 commands</p> sethmlarson tag:github.com,2008:Repository/179495155/fedora-3.12.12-4 2026-02-06T14:54:09Z fedora-3.12.12-4: 00475: CVE-2025-15367 <p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3822983279" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/143923" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/143923/hovercard" href="https://github.com/python/cpython/issues/143923">pythongh-143923</a>: Reject control characters in POP3 commands</p> <p>(cherry-picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7/hovercard" href="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7"><tt>b234a2b</tt></a>)</p> sethmlarson tag:github.com,2008:Repository/179495155/fedora-3.6.15-52 2026-01-25T17:09:56Z fedora-3.6.15-52: 00476: CVE-2026-1299 <p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3839525499" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/144125" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/144125/hovercard" href="https://github.com/python/cpython/issues/144125">pythongh-144125</a>: email: verify headers are sound in BytesGenerator</p> <p>(cherry picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36/hovercard" href="https://github.com/fedora-python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36"><tt>8cdf620</tt></a>)</p> <p>Co-authored-by: Seth Michael Larson <a href="mailto:seth@python.org">seth@python.org</a><br> Co-authored-by: Denis Ledoux <a href="mailto:dle@odoo.com">dle@odoo.com</a><br> Co-authored-by: Denis Ledoux <a href="mailto:5822488+beledouxdenis@users.noreply.github.com">5822488+beledouxdenis@users.noreply.github.com</a><br> Co-authored-by: Petr Viktorin <a href="mailto:302922+encukou@users.noreply.github.com">302922+encukou@users.noreply.github.com</a><br> Co-authored-by: Bas Bloemsaat <a href="mailto:1586868+basbloemsaat@users.noreply.github.com">1586868+basbloemsaat@users.noreply.github.com</a></p> <p>The fix for the CVE uncovered a known issue in handling<br> policy.linesep lengths fixed by:</p> <p>bpo-34424: Handle different policy.linesep lengths correctly. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="351790708" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/8803" data-hovercard-type="pull_request" data-hovercard-url="/python/cpython/pull/8803/hovercard" href="https://github.com/python/cpython/pull/8803">python#8803</a>)</p> <p>(cherry-picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/45b2f8893c1b7ab3b3981a966f82e42beea82106/hovercard" href="https://github.com/fedora-python/cpython/commit/45b2f8893c1b7ab3b3981a966f82e42beea82106"><tt>45b2f88</tt></a>)</p> <p>Co-authored-by: Jens Troeger <a href="mailto:jenstroeger@users.noreply.github.com">jenstroeger@users.noreply.github.com</a></p> miss-islington tag:github.com,2008:Repository/179495155/fedora-3.15.0a5-1 2026-01-14T19:41:49Z fedora-3.15.0a5-1: 00466: Downstream only: Skip tests not working with older expat version <p>We want to run these tests in Fedora and EPEL 10, but not in EPEL 9,<br> which has too old version of expat. We set the upper bound version<br> in the conditionalized skip to a release available in CentOS Stream 10,<br> which is tested as working.</p> befeleme tag:github.com,2008:Repository/179495155/fedora-3.9.25-3 2026-01-14T06:05:16Z fedora-3.9.25-3: 00471: CVE-2025-12084 <ul> <li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3681578558" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/142145" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/142145/hovercard" href="https://github.com/python/cpython/issues/142145">pythongh-142145</a>: Remove quadratic behavior in node ID cache clearing (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3681579274" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/142146" data-hovercard-type="pull_request" data-hovercard-url="/python/cpython/pull/142146/hovercard" href="https://github.com/python/cpython/pull/142146">pythonGH-142146</a>)</li> <li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3731046991" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/142754" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/142754/hovercard" href="https://github.com/python/cpython/issues/142754">pythongh-142754</a>: Ensure that Element &amp; Attr instances have the ownerDocument attribute (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3734288201" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/142794" data-hovercard-type="pull_request" data-hovercard-url="/python/cpython/pull/142794/hovercard" href="https://github.com/python/cpython/pull/142794">pythonGH-142794</a>)<br> (cherry picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/1cc7551b3f9f71efbc88d96dce90f82de98b2454/hovercard" href="https://github.com/fedora-python/cpython/commit/1cc7551b3f9f71efbc88d96dce90f82de98b2454"><tt>1cc7551</tt></a>)<br> (cherry picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4/hovercard" href="https://github.com/fedora-python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4"><tt>08d8e18</tt></a>)<br> (cherry picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907/hovercard" href="https://github.com/fedora-python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907"><tt>8d2d7bb</tt></a>)</li> </ul> <p>Co-authored-by: Jacob Walls <a href="mailto:38668450+jacobtylerwalls@users.noreply.github.com">38668450+jacobtylerwalls@users.noreply.github.com</a><br> Co-authored-by: Seth Michael Larson <a href="mailto:seth@python.org">seth@python.org</a><br> Co-authored-by: Petr Viktorin <a href="mailto:encukou@gmail.com">encukou@gmail.com</a><br> Co-authored-by: Hugo van Kemenade <a href="mailto:1324225+hugovk@users.noreply.github.com">1324225+hugovk@users.noreply.github.com</a><br> Co-authored-by: Gregory P. Smith <a href="mailto:68491+gpshead@users.noreply.github.com">68491+gpshead@users.noreply.github.com</a><br> Co-authored-by: Hugo van Kemenade <a href="mailto:1324225+hugovk@users.noreply.github.com">1324225+hugovk@users.noreply.github.com</a><br> Co-authored-by: Gregory P. Smith <a href="mailto:68491+gpshead@users.noreply.github.com">68491+gpshead@users.noreply.github.com</a><br> Co-authored-by: Gregory P. Smith <a href="mailto:greg@krypto.org">greg@krypto.org</a></p> miss-islington