[Py Blog] Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out

[Py Blog] Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out - Printable Version

+- Sick Gaming (https://sickgaming.net)
+-- Forum: Programming (https://sickgaming.net/forum-76.html)
+--- Forum: Python (https://sickgaming.net/forum-83.html)
+--- Thread: [Py Blog] Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out (/thread-114200.html)

[Py Blog] Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out - xSicKxBot - 10-25-2026

Here are expedited security releases of Python 3.15, 3.14, 3.13, 3.12 and 3.11.

They address the compromised eMudhra intermediate CA keys.
These keys are now blocked by the

Code:
ssl

module as a last resort against their use.
Normal uses of

Code:
pip

, including to upgrade

Code:
pip

itself, are now safe from attacks based on those compromised keys, even if

Code:
pip

hasn’t been updated yet.

Python 3.15.2 and 3.14.10 come with binary installers.
Python 3.13.18, 3.12.16 and 3.11.18 are source-only security releases.

Security content in all five releases

CVE-2026-115557 — gh-160040: Distrust compromised eMudhra intermediate CA keys
CVE-2026-114583 — gh-160097: Reject links replacing the destination in
Code:
tarfile.tar_filter
gh-160300: Reject cookies with a negative version in
Code:
http.cookiejar

Additional security content by version

Python 3.13.18, 3.12.16 and 3.11.18

These fixes were already included in Python 3.15.1 and 3.14.9.

CVE-2026-77214 and CVE-2026-102633 — gh-158876: Update bundled Expat to 2.9.0
CVE-2024-3220 — gh-159428: Don’t read
Code:
mimetypes.knownfiles
by default on Windows
gh-87720: Fix additional header refolding-quoting edge case

Python 3.13.18 and 3.12.16

This fix was already included in Python 3.15.0 and 3.14.9.

gh-157579: Fix race condition in the cleanup of
Code:
tempfile.TemporaryDirectory

For the full details, see the 3.15.2 changelog, 3.14.10 changelog, 3.13.18 changelog, 3.12.16 changelog and 3.11.18 changelog.

Stay safe and upgrade!

As always, upgrading is highly recommended to all users of affected versions.

Enjoy the new releases

Thanks to all of the many volunteers who help make Python development and these releases possible! Please consider supporting our efforts by volunteering yourself or through organisation contributions to the Python Software Foundation.

Your certified release team,

Hugo van Kemenade

Thomas Wouters

Pablo Galindo Salgado

Ned Deily

Steve Dower