RHLW-2026-6b8c47c36cb2c9c6: Lightwell Security Advisory: pyathena 3.31.0+rhlw.1
Red Hat Lightwell has released pyathena 3.31.0+rhlw.1 with a backported security fix.
CVE-2026-65321: PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS
This patched artifact is a drop-in replacement for pyathena 3.31.0 from PyPI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/pyathenato a version that resolves this vulnerability.Fixed in 3.31.0+rhlw.1 - Upgrade
Upgrade
pyathenato a version that resolves this vulnerability.Fixed in 3.31.0+rhlw.1
Event History
Frequently Asked Questions
Which deployments should be prioritized for replacement?
Prioritize deployments using pyathena 3.31.0 from PyPI. The advisory identifies pyathena 3.31.0+rhlw.1 as the patched replacement.
Does moving to the patched artifact require application changes?
The patched pyathena 3.31.0+rhlw.1 artifact is described as a drop-in replacement for pyathena 3.31.0 from PyPI.
What level of attacker access is indicated by the severity vector?
The supplied CVSS vector indicates network attackability, low attack complexity, no required privileges, and no user interaction. It also indicates high potential impact to confidentiality, integrity, and availability.