This advisory addresses CVE-2026-11940, a directory traversal vulnerability in CPython's tarfile module that allows an attacker to bypass extraction filters and write files outside the intended destination directory. Red Hat Product Security has rated this update as Important, though a specific CVSS score is not provided in the article. The update applies to the python3.14 package for Red Hat Enterprise Linux 9 and its Extended Update Support variants, and the solution is to apply the referenced Red Hat security patch.
Red Hat Product Errata RHSA-2026:58901 - Security Advisory Issued: 2026-08-24 Updated: 2026-08-24 RHSA-2026:58901 - Security Advisory Overview Updated Packages Synopsis Important: python3.14 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for python3.14 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat CodeReady Linux Builder for x86_64 9 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le Red Hat CodeReady Linux Builder for ARM 64 9 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2491848 - CVE-2026-11940 python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVEs CVE-2026-11940 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM python3.14-3.14.7-2.el9_8.src.rpm SHA-256: 7446207672834d291246c5559aeab9c35ee0d0e1650a3d45c5887e0418017fa2 x86_64 python3.14-3.14.7-2.el9_8.x86_64.rpm SHA-256: 95b67f74c8e21c7c0c93e9d358f3f46b076658ed143c37c7f7fdde06757cfc58 python3.14-debuginfo-3.14.7-2.el9_8.i686.rpm SHA-256: 56664753e6bf5cee87063ed7ef7f3166276cb3fc7476683f2b6f9adf39ccd2f9 python3.14-debuginfo-3.14.7-2.el9_8.x86_64.rpm SHA-256: 9948e6320dff2c20974d099629f9a9cfc9ed4fd8d23459937f3d77be3742d9eb python3.14-debugsource-3.14.7-2.el9_8.i686.rpm SHA-256: d57f6af6edca912eca170d033aa3fdc07de0580d2a6a6b1288a39a9caee09595 python3.14-debugsource-3.14.7-2.el9_8.x86_64.rpm SHA-256: 6f4e645024eefff0d19db8c24f5da6df8279407a287fa630fd0cf65cdcd19136 python3.14-devel-3.14.7-2.el9_8.i686.rpm SHA-256: 07392b7fb558f1dc3d434a72108a60b057d3fa38009b0b50fec699899ae19231 python3.14-devel-3.14.7-2.el9_8.x86_64.rpm SHA-256: b819bc66b0029d2a5ffffab0ac7489dc91a43cd2f14a1aa9e9940b45d64881a9 python3.14-libs-3.14.7-2.el9_8.i686.rpm SHA-256: 60ae58663072fc88153a848c797f648090a36dd00c79396638c1de05f9322e66 python3.14-libs-3.14.7-2.el9_8.x86_64.rpm SHA-256: 8224d26684597ab5a9a17e215fe801b2a5e5adda191b2da8fc396a6dd2d282c7 python3.14-tkinter-3.14.7-2.el9_8.x86_64.rpm SHA-256: ec4d991905d883577b79b76730897a93e21aa1e367f84b909e8501c9c803e745 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM python3.14-3.14.7-2.el9_8.src.rpm SHA-256: 7446207672834d291246c5559aeab9c35ee0d0e1650a3d45c5887e0418017fa2 x86_64 python3.14-3.14.7-2.el9_8.x86_64.rpm SHA-256: 95b67f74c8e21c7c0c93e9d358f3f46b076658ed143c37c7f7fdde06757cfc58 python3.14-debuginfo-3.14.7-2.el9_8.i686.rpm SHA-256: 56664753e6bf5cee87063ed7ef7f3166276cb3fc7476683f2b6f9adf39ccd2f9 python3.14-debuginfo-3.14.7-2.el9_8.x86_64.rpm SHA-256: 9948e6320dff2c20974d099629f9a9cfc9ed4fd8d23459937f3d77be3742d9eb python3.14-debugsource-3.14.7-2.el9_8.i686.rpm SHA-256: d57f6af6edca912eca170d033aa3fdc07de0580d2a6a6b1288a39a9caee09595 python3.14-debugsource-3.14.7-2.el9_8.x86_64.rpm SHA-256: 6f4e645024eefff0d19db8c24f5da6df8279407a287fa630fd0cf65cdcd19136 python3.14-devel-3.14.7-2.el9_8.i686.rpm SHA-256: 07392b7fb558f1dc3d434a72108a60b057d3fa38009b0b50fec699899ae19231 python3.14-devel-3.14.7-2.el9_8.x86_64.rpm SHA-256: b819bc66b0029d2a5ffffab0ac7489dc91a43cd2f14a1aa9e9940b45d64881a9 python3.14-libs-3.14.7-2.el9_8.i686.rpm SHA-256: 60ae58663072fc88153a848c797f648090a36dd00c79396638c1de05f9322e66 python3.14-libs-3.14.7-2.el9_8.x86_64.rpm SHA-256: 8224d26684597ab5a9a17e215fe801b2a5e5adda191b2da8fc396a6dd2d282c7 python3.14-tkinter-3.14.7-2.el9_8.x86_64.rpm SHA-256: ec4d991905d883577b79b76730897a93e21aa1e367f84b909e8501c9c803e745 Red Hat Enterprise Linux for IBM z Systems 9 SRPM python3.14-3.14.7-2.el9_8.src.rpm SHA-256: 7446207672834d291246c5559aeab9c35ee0d0e1650a3d45c5887e0418017fa2 s390x python3.14-3.14.7-2.el9_8.s390x.rpm SHA-256: 910b745c9743ce8341fe40a8de4d1815d20c45668bf73347011e52f58f980691 python3.14-debuginfo-3.14.7-2.el9_8.s390x.rpm SHA-256: e0b09d5f134770aa9a4cad001324eadf6574d4737c5f82569c5db1fdbe0216e6 python3.14-debugsource-3.14.7-2.el9_8.s390x.rpm SHA-256: 362a17d2f146c607d60f3c813197e9b76d02be9296e660377bc869d1d9bf5199 python3.14-devel-3.14.7-2.el9_8.s390x.rpm SHA-256: f5e6f7b9a7aa22b1eabace0e9ce7b29ae0f9f77a84e5cabe9fb39436336dceda python3.14-libs-3.14.7-2.el9_8.s390x.rpm SHA-256: 554e033179b91759073b58a2f749533a1d9e8ddac37964debef2f4399c94a4f4 python3.14-tkinter-3.14.7-2.el9_8.s390x.rpm SHA-256: b1c7788ac5542cbcff060e43e1c560d68a3d9c18666a74431a30e216377faaa7 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 SRPM python3.14-3.14.7-2.el9_8.src.rpm SHA-256: 7446207672834d291246c5559aeab9c35ee0d0e1650a3d45c5887e0418017fa2 s390x python3.14-3.14.7-2.el9_8.s390x.rpm SHA-256: 910b745c9743ce8341fe40a8de4d1815d20c45668bf73347011e52f58f980691 python3.14-debuginfo-3.14.7-2.el9_8.s390x.rpm SHA-256: e0b09d5f134770aa9a4cad001324eadf6574d4737c5f82569c5db1fdbe0216e6 python3.14-debugsource-3.14.7-2.el9_8.s390x.rpm SHA-256: 362a17d2f146c607d60f3c813197e9b76d02be9296e660377bc869d1d9bf5199 python3.14-devel-3.14.7-2.el9_8.s390x.rpm SHA-256: f5e6f7b9a7aa22b1eabace0e9ce7b29ae0f9f77a84e5cabe9fb39436336dceda python3.14-libs-3.14.7-2.el9_8.s390x.rpm SHA-256: 554e033179b91759073b58a2f749533a1d9e8ddac37964debef2f4399c94a4f4 python3.14-tkinter-3.14.7-2.el9_8.s390x.rpm SHA-256: b1c7788ac5542cbcff060e43e1c560d68a3d9c18666a74431a30e216377faaa7 Red Hat Enterprise Linux for Power, little endian 9 SRPM python3.14-3.14.7-2.el9_8.src.rpm SHA-256: 7446207672834d291246c5559aeab9c35ee0d0e1650a3d45c5887e0418017fa2 ppc64le python3.14-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 024728107fecaf11a0f6bffd888400021174eb54c6a62210fb3e3b23c4ef9707 python3.14-debuginfo-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 1313f7cad403006caef327c33a30443b43ab59accfb938b6e8062bb8ea8f81cd python3.14-debugsource-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 976b26810a54e729f671e6f1a9cf132376bb91a0d03f9ba728c6fb1d21a6c48e python3.14-devel-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 64eff404fa8a50eab2774c27d2f22b50198d949a159fb8e9d6e49fff194c659a python3.14-libs-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 1333c68477561115c4377a10a42fcb2c700af60f27ea19e996bc9fc0c429f542 python3.14-tkinter-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 96a7f6ccdf65c53c3e69d93d44bbfaeb541a7cf967068750fb3a432eef8df964 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 SRPM python3.14-3.14.7-2.el9_8.src.rpm SHA-256: 7446207672834d291246c5559aeab9c35ee0d0e1650a3d45c5887e0418017fa2 ppc64le python3.14-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 024728107fecaf11a0f6bffd888400021174eb54c6a62210fb3e3b23c4ef9707 python3.14-debuginfo-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 1313f7cad403006caef327c33a30443b43ab59accfb938b6e8062bb8ea8f81cd python3.14-debugsource-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 976b26810a54e729f671e6f1a9cf132376bb91a0d03f9ba728c6fb1d21a6c48e python3.14-devel-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 64eff404fa8a50eab2774c27d2f22b50198d949a159fb8e9d6e49fff194c659a python3.14-libs-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 1333c68477561115c4377a10a42fcb2c700af60f27ea19e996bc9fc0c429f542 python3.14-tkinter-3.14.7-2.el9_8.ppc64le.rpm SHA-256: 96a7f6ccdf65c53c3e69d93d44bbfaeb541a7cf967068750fb3a432eef8df964 Red Hat Enterprise Linux for ARM 64 9 SRPM python3.14-3.14.7-2.el9_8.src.rpm SHA-256: 7446207672834d291246c5559aeab9c35ee0d0e1650a3d45c5887e0418017fa2 aarch64 python3.14-3.14.7-2.el9_8.aarch64.rpm