Important: python3.14 security, bug fix, and enhancement update

Important: python3.14 security, bug fix, and enhancement update

ELSA-2026-28581: python3.14 security, bug fix, and enhancement update (IMPORTANT)

ELSA-2026-28247: python3.14 security, bug fix, and enhancement update (IMPORTANT)

Security update for python311

Security update for python311

Security update for python312

Security update for python313

Security update for python310

Security update for python3

Security update for python

Security update for python39

Security update for python, python-base, python-doc

Security update for python3

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

BaseCookie.js_output() does not neutralize embedded characters

http.cookies.Morsel.js_output() returns an inline <script> snippet and ...

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.