Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100

Resolves: rhbz#2457944, rhbz#2458224, rhbz#2458488, rhbz#2458016

python3.14.spec

@@ -49,7 +49,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -447,6 +447,30 @@ Patch475: 00475-cve-2025-15367.patch
 # direct call to the check function.
 Patch477: 00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch
 
+# 00479 # 97404b2cf62e545c2d41be7ccfed4e74da9ee665
+# CVE-2026-1502
+#
+# Reject CR/LF in HTTP tunnel request headers
+Patch479: 00479-cve-2026-1502.patch
+
+# 00480 # 858691f36890b33e713f330d24c6670329695c2e
+# CVE-2026-4786
+#
+# Fix webbrowser `%%action` substitution bypass of dash-prefix check
+Patch480: 00480-cve-2026-4786.patch
+
+# 00481 # 4c1fd39918651c4559a4835d42b86639a192c2c5
+# CVE-2026-5713
+#
+# Validate remote debug offset tables on load
+Patch481: 00481-cve-2026-5713.patch
+
+# 00482 # 69f14bc306fc62400d45565faa980b77858b9151
+# CVE-2026-6100
+#
+# Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor
+Patch482: 00482-cve-2026-6100.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -2000,6 +2024,10 @@ CheckPython freethreading
 # ======================================================
 
 %changelog
+* Thu Apr 16 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.14.4-2
+- Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100
+Resolves: rhbz#2457944, rhbz#2458224, rhbz#2458488, rhbz#2458016
+
 * Wed Apr 08 2026 Karolina Surma <ksurma@redhat.com> - 3.14.4-1
 - Update to Python 3.14.4