RHLW-2026-76e1c0b25e90b430: Lightwell Security Advisory: pyathena 3.35.1+rhlw.1
Published Nov 10, 2026
·Updated
Red Hat Lightwell has released pyathena 3.35.1+rhlw.1 with a backported security fix.
CVE-2026-65321: PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS
This patched artifact is a drop-in replacement for pyathena 3.35.1 from PyPI.
Affected Software
1 affected componentFixes available
red-hat-lightwell/pyathena<3.35.1+rhlw.1
3.35.1+rhlw.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/pyathenato a version that resolves this vulnerability.Fixed in 3.35.1+rhlw.1 - Upgrade
Upgrade
pyathenato a version that resolves this vulnerability.Fixed in 3.35.1+rhlw.1
Event History
Nov 10, 2026
Advisory Published
via OSV·03:55 PM
Data Sourced
via OSV·03:55 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What deployment action is available for users of the PyPI pyathena 3.35.1 package?
Red Hat Lightwell provides pyathena 3.35.1+rhlw.1 as a drop-in replacement for pyathena 3.35.1 from PyPI. The release includes a backported security fix for the SQL injection issue.
2
Which SQL operations are identified as affected by this issue?
The advisory identifies SQL injection through DefaultParameterFormatter in DELETE and CTAS operations.