Security-only releases for Python 3.12.13, 3.11.15, and 3.10.20 are now available. These source-only releases address multiple CVEs and security issues across email header handling (CVE-2024-6923), XML parsing via libexpat upgrade to 2.7.4 (CVE-2026-24515, CVE-2026-25210, CVE-2025-59375), HTTP/cookie/URL control character injection, denial-of-service vulnerabilities in plistlib, http.client, http.server, and os.path.expandvars(), HTML parser hardening, and an SSL use-after-free bug. Python 3.11 and 3.10 also include fixes for use-after-free and out-of-bounds access in list operations under concurrent inputs. All users on affected versions are urged to upgrade.
Sort: