SB20260216149 - Ubuntu update for python3.10
Published: February 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2025-11468)
The vulnerability allows a remote attacker to perform a spoofing attack.
The vulnerability exists due to insufficient validation of user-supplied input in Lib/email/_header_value_parser.py. A remote attacker can manipulate email headers and perform spoofing attack.
2) Inefficient algorithmic complexity (CVE-ID: CVE-2025-12084)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to usage of a quadratic algorithm when building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache(). A remote attacker can force the application to create excessively nested documents, leading to a denial of service condition.
3) Resource exhaustion (CVE-ID: CVE-2025-13837)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in Lib/plistlib.py. A remote attacker can pass a specially crafted file to the application, trigger memory exhaustion and perform a denial of service (DoS) attack.
4) CRLF injection (CVE-ID: CVE-2025-15282)
The vulnerability allows a remote attacker to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data in urllib.request.DataHandler. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.
5) IMAP command injection (CVE-ID: CVE-2025-15366)
The vulnerability allows a remote attacker to execute arbitrary IMAP commands.
The vulnerability exists due to insufficient input validation. A remote attacker can pass specially crafted data to the application and execute arbitrary IMAP commands.
6) POP3 command injection (CVE-ID: CVE-2025-15367)
The vulnerability allows a remote attacker to execute arbitrary POP3 commands.
The vulnerability exists due to insufficient input validation. A remote attacker can pass specially crafted data to the application and execute arbitrary POP3 commands on the server.
7) CRLF injection (CVE-ID: CVE-2026-0672)
The vulnerability allows a remote attacker to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data when using http.cookies.Morsel. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior leading to a spoofing attack.
8) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-0865)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the application and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
Remediation
Install update from vendor's website.