ALAS2-2026-3845

References: CVE-2026-1502  CVE-2026-15308  CVE-2026-3446 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

The incremental HTML parser (html.parser.HTMLParser) allows for CPU
denial-of-service through repeated unterminated markup declarations when
processing uncontrolled data. (CVE-2026-15308)

When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data. (CVE-2026-3446)

Issue Correction:
Run yum update python or yum update --advisory ALAS2-2026-3845 to update your system.

New Packages:

aarch64:
    python-2.7.18-1.amzn2.0.22.aarch64
    python-libs-2.7.18-1.amzn2.0.22.aarch64
    python-devel-2.7.18-1.amzn2.0.22.aarch64
    python-tools-2.7.18-1.amzn2.0.22.aarch64
    tkinter-2.7.18-1.amzn2.0.22.aarch64
    python-test-2.7.18-1.amzn2.0.22.aarch64
    python-debug-2.7.18-1.amzn2.0.22.aarch64
    python-debuginfo-2.7.18-1.amzn2.0.22.aarch64

i686:
    python-2.7.18-1.amzn2.0.22.i686
    python-libs-2.7.18-1.amzn2.0.22.i686
    python-devel-2.7.18-1.amzn2.0.22.i686
    python-tools-2.7.18-1.amzn2.0.22.i686
    tkinter-2.7.18-1.amzn2.0.22.i686
    python-test-2.7.18-1.amzn2.0.22.i686
    python-debug-2.7.18-1.amzn2.0.22.i686
    python-debuginfo-2.7.18-1.amzn2.0.22.i686

src:
    python-2.7.18-1.amzn2.0.22.src

x86_64:
    python-2.7.18-1.amzn2.0.22.x86_64
    python-libs-2.7.18-1.amzn2.0.22.x86_64
    python-devel-2.7.18-1.amzn2.0.22.x86_64
    python-tools-2.7.18-1.amzn2.0.22.x86_64
    tkinter-2.7.18-1.amzn2.0.22.x86_64
    python-test-2.7.18-1.amzn2.0.22.x86_64
    python-debug-2.7.18-1.amzn2.0.22.x86_64
    python-debuginfo-2.7.18-1.amzn2.0.22.x86_64