Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out
Here are expedited security releases of Python 3.15, 3.14, 3.13, 3.12 and 3.11.
They address the compromised eMudhra intermediate CA keys.
These keys are now blocked by the ssl module as a last resort against their use.
Normal uses of pip, including to upgrade pip itself, are now safe from attacks based on those compromised keys, even if pip hasn’t been updated yet.
Python 3.15.2 and 3.14.10 come with binary installers. Python 3.13.18, 3.12.16 and 3.11.18 are source-only security releases.
Security content in all five releases
- CVE-2026-115557 — gh-160040: Distrust compromised eMudhra intermediate CA keys
- CVE-2026-114583 — gh-160097: Reject links replacing the destination in
tarfile.tar_filter - gh-160300: Reject cookies with a negative version in
http.cookiejar
Additional security content by version
Python 3.13.18, 3.12.16 and 3.11.18
These fixes were already included in Python 3.15.1 and 3.14.9.
- CVE-2026-77214 and CVE-2026-102633 — gh-158876: Update bundled Expat to 2.9.0
- CVE-2024-3220 — gh-159428: Don’t read
mimetypes.knownfilesby default on Windows - gh-87720: Fix additional header refolding-quoting edge case
Python 3.13.18 and 3.12.16
This fix was already included in Python 3.15.0 and 3.14.9.
- gh-157579: Fix race condition in the cleanup of
tempfile.TemporaryDirectory
For the full details, see the 3.15.2 changelog, 3.14.10 changelog, 3.13.18 changelog, 3.12.16 changelog and 3.11.18 changelog.
Stay safe and upgrade!
As always, upgrading is highly recommended to all users of affected versions.
Enjoy the new releases
Thanks to all of the many volunteers who help make Python development and these releases possible! Please consider supporting our efforts by volunteering yourself or through organisation contributions to the Python Software Foundation.
Your certified release team,
Hugo van Kemenade
Thomas Wouters
Pablo Galindo Salgado
Ned Deily
Steve Dower