ALAS2023-2026-1600

References: CVE-2026-2297  CVE-2026-3644  CVE-2026-4224 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire. (CVE-2026-2297)

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output(). (CVE-2026-3644)

When an Expat parser with a registered ElementDeclHandler parses an inline
document type definition containing a deeply nested content model a C stack
overflow occurs. (CVE-2026-4224)

Issue Correction:
Run dnf update python3.13 --releasever 2023.11.20260427 or dnf update --advisory ALAS2023-2026-1600 --releasever 2023.11.20260427 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    python3.13-tkinter-3.13.13-1.amzn2023.0.1.aarch64
    python3.13-devel-3.13.13-1.amzn2023.0.1.aarch64
    python3.13-3.13.13-1.amzn2023.0.1.aarch64
    python3.13-idle-3.13.13-1.amzn2023.0.1.aarch64
    python3.13-debugsource-3.13.13-1.amzn2023.0.1.aarch64
    python3.13-debug-3.13.13-1.amzn2023.0.1.aarch64
    python3.13-freethreading-debug-3.13.13-1.amzn2023.0.1.aarch64
    python3.13-libs-3.13.13-1.amzn2023.0.1.aarch64
    python3.13-debuginfo-3.13.13-1.amzn2023.0.1.aarch64
    python3.13-test-3.13.13-1.amzn2023.0.1.aarch64
    python3.13-freethreading-3.13.13-1.amzn2023.0.1.aarch64

src:
    python3.13-3.13.13-1.amzn2023.0.1.src

x86_64:
    python3.13-debugsource-3.13.13-1.amzn2023.0.1.x86_64
    python3.13-libs-3.13.13-1.amzn2023.0.1.x86_64
    python3.13-3.13.13-1.amzn2023.0.1.x86_64
    python3.13-idle-3.13.13-1.amzn2023.0.1.x86_64
    python3.13-freethreading-debug-3.13.13-1.amzn2023.0.1.x86_64
    python3.13-debuginfo-3.13.13-1.amzn2023.0.1.x86_64
    python3.13-freethreading-3.13.13-1.amzn2023.0.1.x86_64
    python3.13-tkinter-3.13.13-1.amzn2023.0.1.x86_64
    python3.13-devel-3.13.13-1.amzn2023.0.1.x86_64
    python3.13-test-3.13.13-1.amzn2023.0.1.x86_64
    python3.13-debug-3.13.13-1.amzn2023.0.1.x86_64