- CVE-2026-2297: CPython's SourcelessFileLoader read legacy .pyc files with a plain _io.FileIO instead of io.open_code(), because FileLoader.get_data() only routed SourceLoader and ExtensionFileLoader subclasses through open_code(). A PEP 578 open_code hook installed to vet code before it is executed was therefore not consulted when a sourceless .pyc was imported, letting code loaded that way escape such validation (CWE-668). Backport of cpython a51b1b51 (gh-145506): SourcelessFileLoader is added to the open_code() branch of FileLoader.get_data(). As in the upstream 3.10 backport 876858c9, the frozen Python/importlib_external.h is regenerated as well - the interpreter executes the frozen blob, not the .py file. - CVE-2026-6879: xml.etree.ElementTree.Element.findall(), a fully consumed Element.iterfind(), and Element.find() when the first match sits near the end of the sibling list had O(n**2) time complexity for XPath index predicates ([1], [last()], [last()-N]), because the predicate re-ran parent.findall(tag) for every candidate sibling. Parsing an attacker-supplied XML document with many same-tag siblings could therefore consume excessive CPU time (CWE-407, inefficient algorithmic complexity). Backport of cpython 2ffab083 (gh-152674): the (parent, tag) lookup is cached so each sibling group is scanned once.