- CVE-2026-87910: tarfile: skip a link member when the extraction filter returns None for its hardlink-extraction fallback instead of ignoring the filter result - CVE-2026-17084: stringprep: build the RFC 3454 B.2/B.3 tables from Unicode 3.2.0 data so IDNA 2003 encoding of newly case-folding characters no longer depends on the interpreter's Unicode version - CVE-2026-15310: zipfile: bound the output of each bzip2/LZMA decompress() call so a small crafted member cannot trigger an unbounded allocation - CVE-2026-9669: bz2: refuse to reuse a BZ2Decompressor after a decompression error, so retrying with the same object can no longer resume from an invalid internal state and write out of bounds - CVE-2026-11972: tarfile: stop the streaming-mode seek() loop at EOF so a member header declaring a huge size no longer makes parsing take exponentially longer