tag:github.com,2008:https://github.com/fedora-python/cpython/releasesRelease notes from cpython2026-02-10T13:52:50Ztag:github.com,2008:Repository/179495155/fedora-3.9.25-62026-02-10T13:52:50Zfedora-3.9.25-6: 00476: CVE-2026-1299<p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3839525499" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/144125" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/144125/hovercard" href="https://github.com/python/cpython/issues/144125">pythongh-144125</a>: email: verify headers are sound in BytesGenerator<br>
(cherry picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413/hovercard" href="https://github.com/fedora-python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413"><tt>052e55e</tt></a>)</p>
<p>Co-authored-by: Seth Michael Larson <a href="mailto:seth@python.org">seth@python.org</a><br>
Co-authored-by: Denis Ledoux <a href="mailto:dle@odoo.com">dle@odoo.com</a><br>
Co-authored-by: Denis Ledoux <a href="mailto:5822488+beledouxdenis@users.noreply.github.com">5822488+beledouxdenis@users.noreply.github.com</a><br>
Co-authored-by: Petr Viktorin <a href="mailto:302922+encukou@users.noreply.github.com">302922+encukou@users.noreply.github.com</a><br>
Co-authored-by: Bas Bloemsaat <a href="mailto:1586868+basbloemsaat@users.noreply.github.com">1586868+basbloemsaat@users.noreply.github.com</a></p>miss-islingtontag:github.com,2008:Repository/179495155/fedora-3.14.3-12026-02-09T15:52:32Zfedora-3.14.3-1<p>00477: Raise an error when importing stdlib modules compiled for a di…</p>encukoutag:github.com,2008:Repository/179495155/fedora-3.11.14-52026-02-09T08:50:21Zfedora-3.11.14-5: 00475: CVE-2025-15367<p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3822983279" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/143923" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/143923/hovercard" href="https://github.com/python/cpython/issues/143923">pythongh-143923</a>: Reject control characters in POP3 commands</p>
<p>(cherry-picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7/hovercard" href="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7"><tt>b234a2b</tt></a>)</p>sethmlarsontag:github.com,2008:Repository/179495155/fedora-3.10.19-42026-02-09T09:37:44Zfedora-3.10.19-4: 00475: CVE-2025-15367<p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3822983279" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/143923" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/143923/hovercard" href="https://github.com/python/cpython/issues/143923">pythongh-143923</a>: Reject control characters in POP3 commands</p>
<p>(cherry-picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7/hovercard" href="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7"><tt>b234a2b</tt></a>)</p>sethmlarsontag:github.com,2008:Repository/179495155/fedora-3.9.25-52026-02-09T10:10:14Zfedora-3.9.25-5: 00475: CVE-2025-15367<p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3822983279" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/143923" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/143923/hovercard" href="https://github.com/python/cpython/issues/143923">pythongh-143923</a>: Reject control characters in POP3 commands</p>
<p>(cherry-picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7/hovercard" href="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7"><tt>b234a2b</tt></a>)</p>sethmlarsontag:github.com,2008:Repository/179495155/fedora-3.13.12-12026-02-06T11:28:48Zfedora-3.13.12-1: 00475: CVE-2025-15367<p>Reject control characters in POP3 commands</p>sethmlarsontag:github.com,2008:Repository/179495155/fedora-3.12.12-42026-02-06T14:54:09Zfedora-3.12.12-4: 00475: CVE-2025-15367<p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3822983279" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/143923" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/143923/hovercard" href="https://github.com/python/cpython/issues/143923">pythongh-143923</a>: Reject control characters in POP3 commands</p>
<p>(cherry-picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7/hovercard" href="https://github.com/fedora-python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7"><tt>b234a2b</tt></a>)</p>sethmlarsontag:github.com,2008:Repository/179495155/fedora-3.6.15-522026-01-25T17:09:56Zfedora-3.6.15-52: 00476: CVE-2026-1299<p><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3839525499" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/144125" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/144125/hovercard" href="https://github.com/python/cpython/issues/144125">pythongh-144125</a>: email: verify headers are sound in BytesGenerator</p>
<p>(cherry picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36/hovercard" href="https://github.com/fedora-python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36"><tt>8cdf620</tt></a>)</p>
<p>Co-authored-by: Seth Michael Larson <a href="mailto:seth@python.org">seth@python.org</a><br>
Co-authored-by: Denis Ledoux <a href="mailto:dle@odoo.com">dle@odoo.com</a><br>
Co-authored-by: Denis Ledoux <a href="mailto:5822488+beledouxdenis@users.noreply.github.com">5822488+beledouxdenis@users.noreply.github.com</a><br>
Co-authored-by: Petr Viktorin <a href="mailto:302922+encukou@users.noreply.github.com">302922+encukou@users.noreply.github.com</a><br>
Co-authored-by: Bas Bloemsaat <a href="mailto:1586868+basbloemsaat@users.noreply.github.com">1586868+basbloemsaat@users.noreply.github.com</a></p>
<p>The fix for the CVE uncovered a known issue in handling<br>
policy.linesep lengths fixed by:</p>
<p>bpo-34424: Handle different policy.linesep lengths correctly. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="351790708" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/8803" data-hovercard-type="pull_request" data-hovercard-url="/python/cpython/pull/8803/hovercard" href="https://github.com/python/cpython/pull/8803">python#8803</a>)</p>
<p>(cherry-picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/45b2f8893c1b7ab3b3981a966f82e42beea82106/hovercard" href="https://github.com/fedora-python/cpython/commit/45b2f8893c1b7ab3b3981a966f82e42beea82106"><tt>45b2f88</tt></a>)</p>
<p>Co-authored-by: Jens Troeger <a href="mailto:jenstroeger@users.noreply.github.com">jenstroeger@users.noreply.github.com</a></p>miss-islingtontag:github.com,2008:Repository/179495155/fedora-3.15.0a5-12026-01-14T19:41:49Zfedora-3.15.0a5-1: 00466: Downstream only: Skip tests not working with older expat version<p>We want to run these tests in Fedora and EPEL 10, but not in EPEL 9,<br>
which has too old version of expat. We set the upper bound version<br>
in the conditionalized skip to a release available in CentOS Stream 10,<br>
which is tested as working.</p>befelemetag:github.com,2008:Repository/179495155/fedora-3.9.25-32026-01-14T06:05:16Zfedora-3.9.25-3: 00471: CVE-2025-12084<ul>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3681578558" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/142145" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/142145/hovercard" href="https://github.com/python/cpython/issues/142145">pythongh-142145</a>: Remove quadratic behavior in node ID cache clearing (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3681579274" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/142146" data-hovercard-type="pull_request" data-hovercard-url="/python/cpython/pull/142146/hovercard" href="https://github.com/python/cpython/pull/142146">pythonGH-142146</a>)</li>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3731046991" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/142754" data-hovercard-type="issue" data-hovercard-url="/python/cpython/issues/142754/hovercard" href="https://github.com/python/cpython/issues/142754">pythongh-142754</a>: Ensure that Element & Attr instances have the ownerDocument attribute (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3734288201" data-permission-text="Title is private" data-url="https://github.com/python/cpython/issues/142794" data-hovercard-type="pull_request" data-hovercard-url="/python/cpython/pull/142794/hovercard" href="https://github.com/python/cpython/pull/142794">pythonGH-142794</a>)<br>
(cherry picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/1cc7551b3f9f71efbc88d96dce90f82de98b2454/hovercard" href="https://github.com/fedora-python/cpython/commit/1cc7551b3f9f71efbc88d96dce90f82de98b2454"><tt>1cc7551</tt></a>)<br>
(cherry picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4/hovercard" href="https://github.com/fedora-python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4"><tt>08d8e18</tt></a>)<br>
(cherry picked from commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/fedora-python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907/hovercard" href="https://github.com/fedora-python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907"><tt>8d2d7bb</tt></a>)</li>
</ul>
<p>Co-authored-by: Jacob Walls <a href="mailto:38668450+jacobtylerwalls@users.noreply.github.com">38668450+jacobtylerwalls@users.noreply.github.com</a><br>
Co-authored-by: Seth Michael Larson <a href="mailto:seth@python.org">seth@python.org</a><br>
Co-authored-by: Petr Viktorin <a href="mailto:encukou@gmail.com">encukou@gmail.com</a><br>
Co-authored-by: Hugo van Kemenade <a href="mailto:1324225+hugovk@users.noreply.github.com">1324225+hugovk@users.noreply.github.com</a><br>
Co-authored-by: Gregory P. Smith <a href="mailto:68491+gpshead@users.noreply.github.com">68491+gpshead@users.noreply.github.com</a><br>
Co-authored-by: Hugo van Kemenade <a href="mailto:1324225+hugovk@users.noreply.github.com">1324225+hugovk@users.noreply.github.com</a><br>
Co-authored-by: Gregory P. Smith <a href="mailto:68491+gpshead@users.noreply.github.com">68491+gpshead@users.noreply.github.com</a><br>
Co-authored-by: Gregory P. Smith <a href="mailto:greg@krypto.org">greg@krypto.org</a></p>miss-islington