Security fix for CVE-2026-4519 (rhbz#2449727)

python3.11.spec

@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -364,6 +364,12 @@ Patch474: 00474-cve-2025-15366.patch
 # (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
 Patch475: 00475-cve-2025-15367.patch
 
+# 00478 # 40c5c88950b10eaf1c10c5afcc39887b8e23c997
+# CVE-2026-4519
+#
+# Reject leading dashes in webbrowser URLs (GH-143931) (GH-146364)
+Patch478: 00478-cve-2026-4519.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1692,6 +1698,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Mar 26 2026 Lumír Balhar <lbalhar@redhat.com> - 3.11.15-2
+- Security fix for CVE-2026-4519 (rhbz#2449727)
+
 * Tue Mar 03 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.15-1
 - Update to 3.11.15