Back Linuxsecurity

Fedora Python 3.15 Severe Command Injection Arbitrary Exec Vulnerability

Linuxsecurity •LinuxSecurity Advisories • May 23, 2026

[ 1 ] Bug #2457945 - CVE-2026-1502 python3.15: Python: HTTP header injection via CR/LF in proxy tunnel headers [fedora-all] [ 2 ] Bug #2458017 - CVE-2026-6100 python3.15: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all] [ 3 ] Bug #2458225 - CVE-2026-4786 python3.15: Python: Arbitrary code execution via command injection in webbrowser.open() API [fedora-all] [ 4 ] Bug #2458489 - CVE-2026-5713 python3.15: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. [fedora-all] [ 5 ] Bug #2461289 - CVE-2026-3219 python3.15: pip: Incorrect file installation due to improper archive handling [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-2ee2d7abd5' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs in Python 3.15 Affect Fedora Users On May 23, 2026, Fedora released security advisories for Python 3.15, addressing multiple vulnerabilities including CVE-2026-1502, CVE-2026-6100, CVE-2026-4786, CVE-2026-5713, and CVE-2026-3219. These vulnerabilities allow for arbitrary code execution, information disclosure, and HTTP header injection, impacting users of Fedora 42 and 43. The most critical issues involve command injection in the webbrowser.open() API and use-after-free vulnerabilities in decompression modules. Users are advised to apply the updates using the 'dnf' package manager. The vulnerabilities were published between April 10 and April 20, 2026, indicating a significant risk for systems running affected versions of Python. Immediate action is recommended to mitigate potential exploitation. 3 sources 74

Extracted Entities

Fedora Python 3.15 Severe Command Injection Arbitrary Exec Vulnerability

The full story

Extracted Entities

Companies (1)

CVEs (5)

CWE Weaknesses (4)

Platforms (1)