Security fix for CVE-2026-4519 (rhbz#2449730)

python3.14.spec

@@ -49,7 +49,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -444,6 +444,12 @@ Patch475: 00475-cve-2025-15367.patch
 # direct call to the check function.
 Patch477: 00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch
 
+# 00478 # d9d794656850591a4e6aeddcf853505aeea08028
+# CVE-2026-4519
+#
+# Reject leading dashes in webbrowser URLs (GH-146214)
+Patch478: 00478-cve-2026-4519.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1997,6 +2003,9 @@ CheckPython freethreading
 # ======================================================
 
 %changelog
+* Thu Mar 26 2026 Lumír Balhar <lbalhar@redhat.com> - 3.14.3-2
+- Security fix for CVE-2026-4519 (rhbz#2449730)
+
 * Wed Feb 04 2026 Karolina Surma <ksurma@redhat.com> - 3.14.3-1
 - Update to Python 3.14.3
 - Fix CVE-2025-15366, CVE-2025-15367