## This update for python311 fixes the following issues: * CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611). * CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). * CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969). * CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240). * CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted Unicode input (bsc#1267581). * CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).

* bsc#1259240

* bsc#1259611

* bsc#1259734

* bsc#1259735

* bsc#1260026

* bsc#1261969

* bsc#1262098

* bsc#1262319

* bsc#1264962

* bsc#1265268

* bsc#1267581

* bsc#1267821

* bsc#1267974

* bsc#1268977

* bsc#1269066

* bsc#1269788

* bsc#1269959

* bsc#1271192

* bsc#1276223

* bsc#1276226

Cross-

* CVE-2021-4189

* CVE-2025-13462

* CVE-2025-4330

* CVE-2026-0864

* CVE-2026-11940

* CVE-2026-11972

* CVE-2026-1502

* CVE-2026-15308

* CVE-2026-15806

* CVE-2026-17084

* CVE-2026-2297

* CVE-2026-3276

* CVE-2026-3644

* CVE-2026-4224

* CVE-2026-4360

* CVE-2026-45186

* CVE-2026-4519

* CVE-2026-4786

* CVE-2026-6100

* CVE-2026-7210

* CVE-2026-72522

* CVE-2026-7774

* CVE-2026-8328

* CVE-2026-9669

CVSS scores:

* CVE-2021-4189 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N