ALAS2023-2026-1999

References: CVE-2026-0864  CVE-2026-15308  CVE-2026-4360 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file could be injected with unexpected keys and values if the
attacker controls the written value. (CVE-2026-0864)

The incremental HTML parser (html.parser.HTMLParser) allows for CPU
denial-of-service through repeated unterminated markup declarations when
processing uncontrolled data. (CVE-2026-15308)

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function. (CVE-2026-4360)

Issue Correction:
Run dnf update python3.14 --releasever 2023.12.20260803 or dnf update --advisory ALAS2023-2026-1999 --releasever 2023.12.20260803 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    python3.14-freethreading-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-debugsource-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-debug-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-freethreading-tkinter-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-idle-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-tkinter-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-freethreading-idle-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-devel-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-freethreading-debug-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-test-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-freethreading-devel-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-freethreading-libs-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-debuginfo-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-libs-3.14.6-1.amzn2023.0.3.aarch64
    python3.14-freethreading-test-3.14.6-1.amzn2023.0.3.aarch64

src:
    python3.14-3.14.6-1.amzn2023.0.3.src

x86_64:
    python3.14-freethreading-devel-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-freethreading-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-freethreading-idle-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-freethreading-debug-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-tkinter-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-freethreading-tkinter-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-devel-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-idle-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-debugsource-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-debug-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-libs-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-debuginfo-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-freethreading-libs-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-freethreading-test-3.14.6-1.amzn2023.0.3.x86_64
    python3.14-test-3.14.6-1.amzn2023.0.3.x86_64