Security-only releases for Python 3.12.13, 3.11.15, and 3.10.20 are now available. These source-only releases address multiple CVEs and security issues across email header handling (CVE-2024-6923), XML parsing via libexpat upgrade to 2.7.4 (CVE-2026-24515, CVE-2026-25210, CVE-2025-59375), HTTP/cookie/URL control character injection, denial-of-service vulnerabilities in plistlib, http.client, http.server, and os.path.expandvars(), HTML parser hardening, and an SSL use-after-free bug. Python 3.11 and 3.10 also include fixes for use-after-free and out-of-bounds access in list operations under concurrent inputs. All users on affected versions are urged to upgrade.

3m read timeFrom blog.python.org
Post cover image
Table of contents
Security content in these releasesStay safe and upgrade!Enjoy the new releases

Sort: