SB2026021353 - Fedora 43 update for mingw-python3
Published: February 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2025-11468)
The vulnerability allows a remote attacker to perform a spoofing attack.
The vulnerability exists due to insufficient validation of user-supplied input in Lib/email/_header_value_parser.py. A remote attacker can manipulate email headers and perform spoofing attack.
2) CRLF injection (CVE-ID: CVE-2026-0672)
The vulnerability allows a remote attacker to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data when using http.cookies.Morsel. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior leading to a spoofing attack.
3) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-0865)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the application and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
4) CRLF injection (CVE-ID: CVE-2025-15282)
The vulnerability allows a remote attacker to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data in urllib.request.DataHandler. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.
5) CRLF injection (CVE-ID: CVE-2026-1299)
The vulnerability allows a remote attacker to inject arbitrary header into email messages.
The vulnerability exists due to insufficient validation of attacker-supplied data in "BytesGenerator" class. A remote attacker can pass specially crafted data to the application containing CR-LF characters and perform a spoofing attack.
Remediation
Install update from vendor's website.