# SUSE-SU-2026:4534-1: Security update for 2 packages SUSE-SU-2026:4534-1, released October 6, 2026, fixes 26 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/suse-su-2026-4534-1 - Platform: Linux - Released: Oct 6, 2026 - Priority: High (Closes CVE-2021-4189, high severity) - CVEs: 26, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:4534-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [python312](https://patchblox.com/security/data/product/linux/python312.md) | sles 15.6 | 3.12.14-150600.3.68.1 | | [python312-core](https://patchblox.com/security/data/product/linux/python312-core.md) | sles 15.6 | 3.12.14-150600.3.68.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2021-4189](https://patchblox.com/security/data/cve/CVE-2021-4189.md) | High | Python 3.7 and 3 others: Unchecked Return Value | 8.8 | 0.0361 | | | [CVE-2025-4330](https://patchblox.com/security/data/cve/CVE-2025-4330.md) | High | Extraction filter bypass for linking outside extraction directory | 7.6 | 0.0097 | | | [CVE-2026-11940](https://patchblox.com/security/data/cve/CVE-2026-11940.md) | High | tarfile extraction filter bypass allows escaping the destination directory | 7.8 | 0.0075 | | | [CVE-2026-4224](https://patchblox.com/security/data/cve/CVE-2026-4224.md) | High | Stack overflow parsing XML with deeply nested DTD content models | 8.1 | 0.0072 | | | [CVE-2026-11972](https://patchblox.com/security/data/cve/CVE-2026-11972.md) | High | tarfile opened in streaming mode mishandles EOF | 8.2 | 0.0072 | | | [CVE-2026-7210](https://patchblox.com/security/data/cve/CVE-2026-7210.md) | High | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 7.5 | 0.0067 | | | [CVE-2026-15308](https://patchblox.com/security/data/cve/CVE-2026-15308.md) | High | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | 8.7 | 0.0064 | | | [CVE-2026-6100](https://patchblox.com/security/data/cve/CVE-2026-6100.md) | High | Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure | 9.1 | 0.0059 | | | [CVE-2026-1502](https://patchblox.com/security/data/cve/CVE-2026-1502.md) | High | HTTP client proxy tunnel headers not validated for CR/LF | 8.1 | 0.0054 | | | [CVE-2026-3644](https://patchblox.com/security/data/cve/CVE-2026-3644.md) | High | Incomplete control character validation in http.cookies | 8.1 | 0.0051 | | | [CVE-2026-45186](https://patchblox.com/security/data/cve/CVE-2026-45186.md) | High | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. | 8.2 | 0.0048 | | | [CVE-2026-9669](https://patchblox.com/security/data/cve/CVE-2026-9669.md) | High | bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow | 8.2 | 0.0043 | | | [CVE-2026-4519](https://patchblox.com/security/data/cve/CVE-2026-4519.md) | High | webbrowser.open() allows leading dashes in URLs | 8.1 | 0.0032 | | | [CVE-2026-4786](https://patchblox.com/security/data/cve/CVE-2026-4786.md) | High | Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() | 8.1 | 0.0030 | | | [CVE-2026-2297](https://patchblox.com/security/data/cve/CVE-2026-2297.md) | High | SourcelessFileLoader does not use io.open_code() | 8.1 | 0.0022 | | | [CVE-2026-17084](https://patchblox.com/security/data/cve/CVE-2026-17084.md) | Routine | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | 6.0 | 0.0073 | | | [CVE-2026-7774](https://patchblox.com/security/data/cve/CVE-2026-7774.md) | Routine | tarfile.data_filter path traversal bypass allows writing outside the extraction directory | 6.9 | 0.0060 | | | [CVE-2026-15806](https://patchblox.com/security/data/cve/CVE-2026-15806.md) | Routine | `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | 6.0 | 0.0053 | | | [CVE-2026-15310](https://patchblox.com/security/data/cve/CVE-2026-15310.md) | Routine | zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits | 2.1 | 0.0053 | | | [CVE-2026-3276](https://patchblox.com/security/data/cve/CVE-2026-3276.md) | Routine | Potential DoS via quadratic complexity in unicodedata.normalize() | 6.3 | 0.0049 | | | [CVE-2026-4360](https://patchblox.com/security/data/cve/CVE-2026-4360.md) | Routine | Tarfile.extract() doesn't fully respect filter parameter | 5.3 | 0.0048 | | | [CVE-2026-19672](https://patchblox.com/security/data/cve/CVE-2026-19672.md) | Routine | tarfile extraction filter bypass allows creation of directories outside the destination | 6.3 | 0.0047 | | | [CVE-2026-8328](https://patchblox.com/security/data/cve/CVE-2026-8328.md) | Routine | FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address | 5.9 | 0.0046 | | | [CVE-2026-72522](https://patchblox.com/security/data/cve/CVE-2026-72522.md) | Routine | libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions. | 6.2 | 0.0019 | | | [CVE-2025-13462](https://patchblox.com/security/data/cve/CVE-2025-13462.md) | Routine | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling | 3.3 | 0.0018 | | | [CVE-2026-0864](https://patchblox.com/security/data/cve/CVE-2026-0864.md) | Routine | Configuration Injection via Carriage Return (\r) in write() method | 5.5 | 0.0013 | | --- Data as of 2026-11-11T01:20:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.