[Py Blog] Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out

[xSicKxBot]

Here are expedited security releases of Python 3.15, 3.14, 3.13, 3.12 and 3.11.

• Python 3.15.2
  
  
• Python 3.14.10
  
  
• Python 3.13.18
  
  
• Python 3.12.16
  
  
• Python 3.11.18
  
  

They address the compromised eMudhra intermediate CA keys.
These keys are now blocked by the

Code:

ssl

module as a last resort against their use.
Normal uses of

Code:

pip

, including to upgrade

Code:

pip

itself, are now safe from attacks based on those compromised keys, even if

Code:

pip

hasn’t been updated yet.

Python 3.15.2 and 3.14.10 come with binary installers.
Python 3.13.18, 3.12.16 and 3.11.18 are source-only security releases.

Security content in all five releases

• CVE-2026-115557 — gh-160040: Distrust compromised eMudhra intermediate CA keys
  
  
• CVE-2026-114583 — gh-160097: Reject links replacing the destination in
  Code:

  tarfile.tar_filter
  
  
• gh-160300: Reject cookies with a negative version in
  Code:

  http.cookiejar
  
  

Additional security content by version

Python 3.13.18, 3.12.16 and 3.11.18

These fixes were already included in Python 3.15.1 and 3.14.9.

• CVE-2026-77214 and CVE-2026-102633 — gh-158876: Update bundled Expat to 2.9.0
  
  
• CVE-2024-3220 — gh-159428: Don’t read
  Code:

  mimetypes.knownfiles
  by default on Windows
  
  
• gh-87720: Fix additional header refolding-quoting edge case
  
  

Python 3.13.18 and 3.12.16

This fix was already included in Python 3.15.0 and 3.14.9.

• gh-157579: Fix race condition in the cleanup of
  Code:

  tempfile.TemporaryDirectory
  
  

For the full details, see the 3.15.2 changelog, 3.14.10 changelog, 3.13.18 changelog, 3.12.16 changelog and 3.11.18 changelog.

Stay safe and upgrade!

As always, upgrading is highly recommended to all users of affected versions.

Enjoy the new releases

Thanks to all of the many volunteers who help make Python development and these releases possible! Please consider supporting our efforts by volunteering yourself or through organisation contributions to the Python Software Foundation.

Your certified release team,

Hugo van Kemenade

Thomas Wouters

Pablo Galindo Salgado

Ned Deily

Steve Dower