Back Linuxsecurity

Fedora 43 Python3.14 Important Header Injection Fix 2026

Linuxsecurity •LinuxSecurity Advisories • February 26, 2026

Python 3.14 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. Update Information : New minor version of the Python interpreter, bringing also security fixes. 389-ds-base: Fix system index configuration issues 389-ds-base: Fix AttributeError: 'CustomHelpFormatter' object has no attribute '_format_actions_usage'

Python 3.14 is an accessible, high-level, dynamically typed, interpreted

programming language, designed with an emphasis on code readability.

It includes an extensive standard library, and has a vast ecosystem of

third-party libraries.

New minor version of the Python interpreter, bringing also security fixes. 389-ds-base: Fix system index configuration issues 389-ds-base: Fix AttributeError: 'CustomHelpFormatter' object has no attribute '_format_actions_usage'

* Wed Feb 4 2026 Karolina Surma - 3.14.3-1 - Update to Python 3.14.3 - Fix CVE-2025-15366, CVE-2025-15367 * Sat Jan 17 2026 Fedora Release Engineering - 3.14.2-3 - Rebuilt for * Tue Jan 6 2026 Karolina Surma - 3.14.2-2 - Require at least the same expat version as used during the build time

[ 1 ] Bug #2424574 - 389-ds-base fails to build with Python 3.15: AttributeError: 'CustomHelpFormatter' object has no attribute '_format_actions_usage' [ 2 ] Bug #2431825 - CVE-2025-11468 python3.14: Missing character filtering in Python [fedora-43] [ 3 ] Bug #2431837 - CVE-2026-0672 python3.14: Header injection in http.cookies.Morsel in Python [fedora-43] [ 4 ] Bug #2431838 - CVE-2026-0865 python3.14: wsgiref.headers.Headers allows header newline injection in Python [fedora-43] [ 5 ] Bug #2431851 - CVE-2025-15282 python3.14: Header injection via newlines in data URL mediatype in Python [fedora-43] [ 6 ] Bug #2433829 - CVE-2026-1299 python3.14: email header injection... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-27ce708600' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora Python 3.9 Command Injection Vulnerabilities Addressed Fedora has released security updates for the Python 3.9 package, addressing critical command injection vulnerabilities. The updates affect developers using Fedora 42 and Fedora 43, with fixes for CVE-2026-1299, CVE-2026-0865, CVE-2025-15366, and CVE-2025-15367, which were published in January 2026. 16 sources 42

Extracted Entities

CVEs (7)

CVE-2025-11468 CVE-2025-15282 CVE-2025-15366 CVE-2025-15367 CVE-2026-0672 CVE-2026-0865 CVE-2026-1299