Python Releases Emergency Security Updates Across Five Versions
The Python core team has released expedited security patches for versions 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18 to address compromised eMudhra certificate keys and other vulnerabilities.
Python 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18 are out. The core team pushed these expedited security updates to block compromised eMudhra intermediate certificate authority keys in the ssl module. You should upgrade.
Normal pip uses are safe from attacks based on those keys, including upgrading pip itself even if you haven't updated pip yet.
Binary installers ship for Python 3.15.2 and 3.14.10. The other three versions are source-only.
All five get CVE-2026-115557 for the eMudhra keys, CVE-2026-114583 to make tarfile.tar_filter reject links replacing the destination, and gh-160300 to make http.cookiejar reject cookies with a negative version.
The three oldest branches include extra patches previously shipped in newer versions. Python 3.13.18, 3.12.16, and 3.11.18 bump the bundled Expat library to 2.9.0 for CVE-2026-77214 and CVE-2026-102633, stop reading mimetypes.knownfiles by default on Windows for CVE-2024-3220, and fix gh-87720 for header refolding. Furthermore, Python 3.13.18 and 3.12.16 fix a tempfile.TemporaryDirectory cleanup race condition in gh-157579.
Dated October 26, 2026, the announcement lists Hugo van Kemenade, Thomas Wouters, Pablo Galindo Salgado, Ned Deily, and Steve Dower. Check the changelog for details.