REDHAT-BUG-2444691: Low severity Python Software Foundation CPython vulnerability
Published Mar 4, 2026
·Updated
The import hook in CPython that handles legacy .pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.opencode() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Affected Software
1 affected component
Python Software Foundation CPython
Event History
Mar 4, 2026
Data Sourced
via Red Hat·11:01 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-2444691?
The severity of REDHAT-BUG-2444691 is classified as low.
2
How does REDHAT-BUG-2444691 affect Python applications?
REDHAT-BUG-2444691 prevents sys.audit handlers from firing when handling legacy .pyc files.
3
What is the risk associated with REDHAT-BUG-2444691?
The risk associated with REDHAT-BUG-2444691 is rated as 5, indicating a low risk.
4
How do I fix REDHAT-BUG-2444691?
Fixing REDHAT-BUG-2444691 involves ensuring that the FileLoader correctly implements io.open_code() for reading .pyc files.
5
What component of Python is affected by REDHAT-BUG-2444691?
The import hook in CPython is affected by REDHAT-BUG-2444691, specifically the handling of legacy .pyc files.