Back Linuxsecurity

Fedora 42 mingw-python3 2026

Linuxsecurity •LinuxSecurity Advisories • April 28, 2026

MinGW Windows python3 Update Information : Backport fix for CVE-2026-4786. Backport fixes for CVE-2026-6100, CVE-2026-3479, CVE-2026-1502

MinGW Windows python3

Backport fix for CVE-2026-4786. Backport fixes for CVE-2026-6100, CVE-2026-3479, CVE-2026-1502

* Sat Apr 18 2026 Sandro Mani - 3.11.15-4 - Backport fix for CVE-2026-4786 * Tue Apr 14 2026 Sandro Mani - 3.11.15-3 - Backport fixes for CVE-2026-6100, CVE-2026-3479, CVE-2026-1502

[ 1 ] Bug #2449254 - CVE-2026-3479 mingw-python3: Python pkgutil.get_data(): Path Traversal via improper resource argument validation [fedora-all] [ 2 ] Bug #2457939 - CVE-2026-1502 mingw-python3: Python: HTTP header injection via CR/LF in proxy tunnel headers [fedora-all] [ 3 ] Bug #2458011 - CVE-2026-6100 mingw-python3: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all] [ 4 ] Bug #2458219 - CVE-2026-4786 mingw-python3: Python: Arbitrary code execution via command injection in webbrowser.open() API [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-763e814afa' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Addressed in Fedora Python3 Updates On April 28, 2026, Fedora released updates for MinGW Windows python3 to address multiple vulnerabilities. The updates include backports for CVE-2026-4786, CVE-2026-6100, CVE-2026-3479, and CVE-2026-1502. CVE-2026-4786, published on April 13, allows arbitrary code execution via command injection in the webbrowser.open() API. CVE-2026-6100, published on April 13, enables arbitrary code execution or information disclosure through a use-after-free vulnerability in decompression modules. CVE-2026-3479, published on March 18, involves a path traversal vulnerability in pkgutil.get_data(). CVE-2026-1502, published on April 10, allows HTTP header injection via CR/LF in proxy tunnel headers. Users are advised to install the updates using the 'dnf' update program. The vulnerabilities affect users of MinGW Windows python3 and could lead to serious security breaches if exploited. 2 sources 71

Extracted Entities

CVEs (4)

CVE-2026-1502 CVE-2026-3479 CVE-2026-4786 CVE-2026-6100

CWE Weaknesses (4)

CWE-200 - Exposure of Sensitive Information CWE-22 - Path Traversal Cwe-416 - Use After Free CWE-78 - OS Command Injection