This update for python310 fixes the following issues: * CVE-2025-11468: header injection when folding a long in an email header containing exclusively unfoldable characters (bsc#1257029). * CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031). * CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042). * CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044). * CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046). * CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-613=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-613=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-613=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-613=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-613=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-613=1
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
zypper in -t patch SUSE-2026-613=1
zypper in -t patch openSUSE-SLE-15.6-2026-613=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-613=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-613=1
* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-613=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-613=1
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python310-curses-3.10.19-150400.4.97.1 * python310-curses-debuginfo-3.10.19-150400.4.97.1 * python310-core-debugsource-3.10.19-150400.4.97.1 * python310-base-debuginfo-3.10.19-150400.4.97.1 * python310-debuginfo-3.10.19-150400.4.97.1 * libpython3_10-1_0-debuginfo-3.10.19-150400.4.97.1 * python310-doc-3.10.19-150400.4.97.1 * libpython3_10-1_0-3.10.19-150400.4.97.1 * python310-debugsource-3.10.19-150400.4.97.1 * python310-dbm-3.10.19-150400.4.97.1 * python310-tools-3.10.19-150400.4.97.1 * python310-tk-3.10.19-150400.4.97.1 * python310-tk-debuginfo-3.10.19-150400.4.97.1 * python310-dbm-debuginfo-3.10.19-150400.4.97.1 * python310-devel-3.10.19-150400.4.97.1 * python310-idle-3.10.19-150400.4.97.1 * python310-testsuite-3.10.19-150400.4.97.1 * python310-3.10.19-150400.4.97.1 * python310-base-3.10.19-150400.4.97.1 * Read the Full Advisory
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* python310-curses-3.10.19-150400.4.97.1
* python310-curses-debuginfo-3.10.19-150400.4.97.1
* python310-core-debugsource-3.10.19-150400.4.97.1
* python310-base-debuginfo-3.10.19-150400.4.97.1
* python310-debuginfo-3.10.19-150400.4.97.1
* libpython3_10-1_0-debuginfo-3.10.19-150400.4.97.1
* python310-doc-3.10.19-150400.4.97.1
* libpython3_10-1_0-3.10.19-150400.4.97.1
* python310-debugsource-3.10.19-150400.4.97.1
* python310-dbm-3.10.19-150400.4.97.1
* python310-tools-3.10.19-150400.4.97.1
* python310-tk-3.10.19-150400.4.97.1
* python310-tk-debuginfo-3.10.19-150400.4.97.1
* python310-dbm-debuginfo-3.10.19-150400.4.97.1
* python310-devel-3.10.19-150400.4.97.1
* python310-idle-3.10.19-150400.4.97.1
* python310-testsuite-3.10.19-150400.4.97.1
* python310-3.10.19-150400.4.97.1
* python310-base-3.10.19-150400.4.97.1
* bsc#1257029 * bsc#1257031 * bsc#1257041 * bsc#1257042 * bsc#1257044 * bsc#1257046 ## References: * * * * * * * * * * * *
*
*
*
*
*
*
*
*
*
*
*
*
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
