Sick Gaming
[Py Blog] Python 3.12.14, 3.11.16 and 3.10.21 are now available! - Printable Version

+- Sick Gaming (https://sickgaming.net)
+-- Forum: Programming (https://sickgaming.net/forum-76.html)
+--- Forum: Python (https://sickgaming.net/forum-83.html)
+--- Thread: [Py Blog] Python 3.12.14, 3.11.16 and 3.10.21 are now available! (/thread-113229.html)

[Py Blog] Python 3.12.14, 3.11.16 and 3.10.21 are now available! - xSicKxBot - 08-11-2026

Python Releases Eclipse Your Security!

New security releases for 3.10, 3.11 and 3.12 are now available. (As these Python versions are now in security-fix-only mode, these are source-only releases, and there is no pre-set release cadence… but the solar eclipse here in Europe was as good an excuse as any.)

Security content in these releases
  • gh-143930: Reject leading dashes in URLs passed to webbrowser.open().

  • gh-137586: Invoke osascript with absolute path in webbrowser and
    Code:
    turtledemo
    .

  • gh-141707: Don’t change tarfile.TarInfo type from
    Code:
    AREGTYPE
    to
    Code:
    DIRTYPE
    when parsing GNU long name or link headers.

  • gh-146211: Reject CR/LF characters in tunnel request headers for the HTTPConnection.set_tunnel() method.

  • gh-149486: tarfile.data_filter() now validates link targets using the same normalised value that is written to disk, strips trailing separators from the member name when resolving a symlink’s directory, and rejects link members that would replace the destination directory itself. This closes several path-traversal bypasses of the
    Code:
    data
    extraction filter.

  • gh-87451: The ftplib module’s undocumented
    Code:
    ftpcp
    function no longer trusts the IPv4 address value returned from the source server in response to the
    Code:
    PASV
    command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the
    Code:
    trust_server_pasv_ipv4_address
    attribute on the source
    Code:
    ftplib.FTP
    instance to
    Code:
    True
    . Thanks to Qi Deng at Aurascape AI for the report.

  • gh-145506: Fixes CVE 2026-2297 by ensuring that
    Code:
    SourcelessFileLoader
    uses io.open_code() when opening
    Code:
    .pyc
    files.

  • gh-144370: Disallow usage of control characters in status in wsgiref.handlers to prevent HTTP header injections. Patch by Benedikt Johannes.

  • gh-145986: xml.parsers.expat: Fixed a crash caused by unbounded C recursion when converting deeply nested XML content models with ElementDeclHandler(). This addresses CVE 2026-4224.

  • gh-145599: Reject control characters in http.cookies.Morsel update() and js_output(). This addresses CVE 2026-3644.

  • gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
    Code:
    zlib._ZlibDecompressor
    when memory allocation fails with MemoryError, which could let a subsequent
    Code:
    decompress()
    call read or write through a stale pointer to the already-released caller buffer.

  • gh-148169: A bypass in webbrowser allowed URLs prefixed with
    Code:
    %action
    to pass the dash-prefix safety check.

  • gh-148808: Added buffer boundary check when using
    Code:
    nbytes
    parameter with
    Code:
    asyncio.AbstractEventLoop.sock_recvfrom_into()
    . Only relevant for Windows and the asyncio.ProactorEventLoop.

  • gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows which allowed to write files outside of the destination tree if the patch in the archive contains a Windows drive prefix. Now such invalid paths will be skipped. Files containing “..” in the name (like “foo..bar”) are no longer skipped.

  • gh-149079: Fix a potential denial of service in unicodedata.normalize(). The canonical ordering step of Unicode normalization used a quadratic-time insertion sort for reordering combining characters, which could be exploited with crafted input containing many combining characters in non-canonical order. Replaced with a linear-time counting sort for long runs.

  • gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.

  • gh-90949: Add SetBillionLaughsAttackProtectionActivationThreshold() and SetBillionLaughsAttackProtectionMaximumAmplification() to xmlparser objects to tune protections against billion laughs attacks. Patch by Bénédikt Tran.

  • gh-151544:
    Code:
    Modules/Setup.local
    is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The
    Code:
    pybuilddir.txt
    file is now the sole indicator of running in a source tree.

  • gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.

  • gh-151558: Fixed an vulnerability in the tarfile
    Code:
    data
    and
    Code:
    tar
    extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE 2025-4330.

  • gh-143927: Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing multi-line configparser values.

  • gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or
    Code:
    100 Continue
    responses forever, hanging the client even when a socket timeout was in use. Reported by
    Code:
    @YLChen-007
    via GHSA-w4q2-g22w-6fr4.

  • gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.

  • gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.

  • gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option parsing regexes (
    Code:
    OPTCRE
    and
    Code:
    OPTCRE_NV
    ). A crafted configuration line with many whitespace characters could cause excessive CPU usage.

  • gh-149231: In tomllib, the number of parts in TOML keys is now limited.

  • gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates (
    Code:
    [1]
    ,
    Code:
    [last()]
    ,
    Code:
    [last()-N]
    ) on XML documents with many same-tag siblings.

  • gh-109638: Fix exponential time in csv.Sniffer.sniff() for a sample which contains many quote characters. A doubled quote character is now also detected in a field which contains the delimiter or a line break.

  • gh-98820: Fix quadratic time in csv.Sniffer.sniff() for a sample which contains quoted fields, in particular for a single column of quoted fields.

  • gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later.

  • gh-146083, gh-149017, gh-149698, gh-152216: Update bundled libexpat to version 2.8.2.


Python 3.12.14

Additional fixes in this release:

python.org/downloads/release/python-31214

Python 3.11.16

Additional fixes in this release:

python.org/downloads/release/python-31116

Python 3.10.21

Additional fixes in this release:

python.org/downloads/release/python-31021

Stay safe and upgrade!

As always, upgrading is highly recommended to all users of affected versions.

Enjoy the new releases

Thanks to all of the many volunteers who help make Python Development and this release possible! Please consider supporting our efforts by volunteering yourself or through organisation contributions to the Python Software Foundation.

Regards from your sunny release team,
Thomas Wouters
Pablo Galindo Salgado