# Python3 security updates

The latest version of Python3 is 3.13.13, released April 7, 2026. Patch Radar has 0 security fixes for Python3, closing 0 CVEs. 33 CVEs have no fix yet.

- Web page: https://patchblox.com/security/product/macos/python3
- Platform: macOS
- Vendor: Python Software Foundation
- Latest version: 3.13.13 (Apr 7, 2026)
- Supported: yes

## CVEs with no fix yet

| CVE | Priority | Title | Status |
|---|---|---|---|
| [CVE-2026-115557](https://patchblox.com/security/data/cve/CVE-2026-115557.md) | Urgent | Distrust compromised intermediate certificates in ssl module | no-fix |
| [CVE-2026-19445](https://patchblox.com/security/data/cve/CVE-2026-19445.md) | Urgent | Use-after-free of a server-side SSLContext when sni_callback switches contexts | no-fix |
| [CVE-2025-15366](https://patchblox.com/security/data/cve/CVE-2025-15366.md) | High | IMAP command injection in user-controlled commands | no-fix |
| [CVE-2025-15367](https://patchblox.com/security/data/cve/CVE-2025-15367.md) | High | POP3 command injection in user-controlled commands | no-fix |
| [CVE-2026-11940](https://patchblox.com/security/data/cve/CVE-2026-11940.md) | High | tarfile extraction filter bypass allows escaping the destination directory | no-fix |
| [CVE-2026-11972](https://patchblox.com/security/data/cve/CVE-2026-11972.md) | High | tarfile opened in streaming mode mishandles EOF | no-fix |
| [CVE-2026-15308](https://patchblox.com/security/data/cve/CVE-2026-15308.md) | High | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | no-fix |
| [CVE-2026-19553](https://patchblox.com/security/data/cve/CVE-2026-19553.md) | High | SSLContext.wrap_bio() missing validation of server_hostname parameter | no-fix |
| [CVE-2026-3298](https://patchblox.com/security/data/cve/CVE-2026-3298.md) | High | Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes | no-fix |
| [CVE-2026-4786](https://patchblox.com/security/data/cve/CVE-2026-4786.md) | High | Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() | no-fix |
| [CVE-2026-6100](https://patchblox.com/security/data/cve/CVE-2026-6100.md) | High | Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure | no-fix |
| [CVE-2026-7210](https://patchblox.com/security/data/cve/CVE-2026-7210.md) | High | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | no-fix |
| [CVE-2026-82049](https://patchblox.com/security/data/cve/CVE-2026-82049.md) | High | tarfile extraction filters allow file modification and content disclosure via hard link to symlink | no-fix |
| [CVE-2026-9669](https://patchblox.com/security/data/cve/CVE-2026-9669.md) | High | bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow | no-fix |
| [CVE-2024-3220](https://patchblox.com/security/data/cve/CVE-2024-3220.md) | Routine | Default mimetype known files writeable on Windows | no-fix |
| [CVE-2026-0864](https://patchblox.com/security/data/cve/CVE-2026-0864.md) | Routine | Configuration Injection via Carriage Return (\r) in write() method | no-fix |
| [CVE-2026-103995](https://patchblox.com/security/data/cve/CVE-2026-103995.md) | Routine | Lenient parsing of integers for response body and chunk framing | no-fix |
| [CVE-2026-114583](https://patchblox.com/security/data/cve/CVE-2026-114583.md) | Routine | tar filter allows writing outside destination via empty-named symlink | no-fix |
| [CVE-2026-116566](https://patchblox.com/security/data/cve/CVE-2026-116566.md) | Routine | socket.getaddrinfo() accepts embedded null bytes in host and port | no-fix |
| [CVE-2026-12003](https://patchblox.com/security/data/cve/CVE-2026-12003.md) | Routine | CPython >3.11 Insecure Input Validation resulting in privilege escalation | no-fix |
| [CVE-2026-12345](https://patchblox.com/security/data/cve/CVE-2026-12345.md) | Routine | Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory | no-fix |
| [CVE-2026-1502](https://patchblox.com/security/data/cve/CVE-2026-1502.md) | Routine | HTTP client proxy tunnel headers not validated for CR/LF | no-fix |
| [CVE-2026-15310](https://patchblox.com/security/data/cve/CVE-2026-15310.md) | Routine | zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits | no-fix |
| [CVE-2026-15806](https://patchblox.com/security/data/cve/CVE-2026-15806.md) | Routine | `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | no-fix |
| [CVE-2026-17084](https://patchblox.com/security/data/cve/CVE-2026-17084.md) | Routine | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | no-fix |
| [CVE-2026-18503](https://patchblox.com/security/data/cve/CVE-2026-18503.md) | Routine | Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() | no-fix |
| [CVE-2026-19672](https://patchblox.com/security/data/cve/CVE-2026-19672.md) | Routine | tarfile extraction filter bypass allows creation of directories outside the destination | no-fix |
| [CVE-2026-3276](https://patchblox.com/security/data/cve/CVE-2026-3276.md) | Routine | Potential DoS via quadratic complexity in unicodedata.normalize() | no-fix |
| [CVE-2026-6019](https://patchblox.com/security/data/cve/CVE-2026-6019.md) | Routine | BaseCookie.js_output() does not neutralize embedded characters | no-fix |
| [CVE-2026-6879](https://patchblox.com/security/data/cve/CVE-2026-6879.md) | Routine | Quadratic Behavior in xml.etree.ElementPath Index Predicates | no-fix |
| [CVE-2026-7774](https://patchblox.com/security/data/cve/CVE-2026-7774.md) | Routine | tarfile.data_filter path traversal bypass allows writing outside the extraction directory | no-fix |
| [CVE-2026-8328](https://patchblox.com/security/data/cve/CVE-2026-8328.md) | Routine | FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address | no-fix |
| [CVE-2026-87910](https://patchblox.com/security/data/cve/CVE-2026-87910.md) | Routine | tarfile hardlink fallback ignores custom extraction filter rejection via None | no-fix |

## Security fixes, newest first

No security fix is on record.

---

Data as of 2026-11-07T00:32:44Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo