Bug 2444691 (CVE-2026-2297) - CVE-2026-2297 cpython: CPython: Logging Bypass in Legacy .pyc File Handling
Summary: CVE-2026-2297 cpython: CPython: Logging Bypass in Legacy .pyc File Handling
Keywords:
Status: NEW
Alias: CVE-2026-2297
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2444699 2444700 2444701 2444702 2444703 2444704 2444705 2444706 2444707 2444708 2444709 2444710
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-04 23:01 UTC by OSIDB Bzimport
Modified: 2026-03-04 23:46 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-03-04 23:01:32 UTC 
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Note You need to log in before you can comment on or make changes to this bug.