# Python 3.13 security updates

The latest version of Python 3.13 is 3.13.17, released October 21, 2026. Patch Radar has 11 security fixes for Python 3.13, closing 57 CVEs. The newest security fix is Python 3.13 3.13.16, released September 30, 2026. Version 3.13.17 adds no new CVE fixes and includes all of them. 9 CVEs have no fix yet.

- Web page: https://patchblox.com/security/product/windows-app/python-3.13
- Platform: Windows apps
- Vendor: Python Software Foundation
- Latest version: 3.13.17 (Oct 21, 2026)
- Supported: yes

## CVEs with no fix yet

| CVE | Priority | Title | Status |
|---|---|---|---|
| [CVE-2026-115557](https://patchblox.com/security/data/cve/CVE-2026-115557.md) | Urgent | Distrust compromised intermediate certificates in ssl module | no-fix |
| [CVE-2025-15367](https://patchblox.com/security/data/cve/CVE-2025-15367.md) | High | POP3 command injection in user-controlled commands | no-fix |
| [CVE-2026-12345](https://patchblox.com/security/data/cve/CVE-2026-12345.md) | High | Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory | no-fix |
| [CVE-2024-3220](https://patchblox.com/security/data/cve/CVE-2024-3220.md) | Routine | Default mimetype known files writeable on Windows | no-fix |
| [CVE-2026-103995](https://patchblox.com/security/data/cve/CVE-2026-103995.md) | Routine | Lenient parsing of integers for response body and chunk framing | no-fix |
| [CVE-2026-114583](https://patchblox.com/security/data/cve/CVE-2026-114583.md) | Routine | tar filter allows writing outside destination via empty-named symlink | no-fix |
| [CVE-2026-116566](https://patchblox.com/security/data/cve/CVE-2026-116566.md) | Routine | socket.getaddrinfo() accepts embedded null bytes in host and port | no-fix |
| [CVE-2026-19672](https://patchblox.com/security/data/cve/CVE-2026-19672.md) | Routine | tarfile extraction filter bypass allows creation of directories outside the destination | no-fix |
| [CVE-2026-3087](https://patchblox.com/security/data/cve/CVE-2026-3087.md) | Routine | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs | no-fix |

## Security fixes, newest first

| Fix | Released | Fixed in | Priority | CVEs | Exploited |
|---|---|---|---|---:|---:|
| Python 3.13 3.13.17 (latest, includes every fix below) | Oct 21, 2026 | 3.13.17 |  |  |  |
| [Python 3.13 3.13.16](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.16.md) | Sep 30, 2026 | 3.13.16 | Urgent | 7 | 0 |
| [Python 3.13 3.13.15](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.15.md) | Aug 5, 2026 | 3.13.15 | High | 8 | 0 |
| [Python 3.13 3.13.14](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.14.md) | Jun 10, 2026 | 3.13.14 | High | 10 | 0 |
| [Python 3.13 3.13.13](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.13.md) | Apr 7, 2026 | 3.13.13 | High | 7 | 0 |
| [Python 3.13 3.13.12](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.12.md) | Feb 3, 2026 | 3.13.12 | High | 5 | 0 |
| [Python 3.13 3.13.11](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.11.md) | Dec 5, 2025 | 3.13.11 | High | 3 | 0 |
| [Python 3.13 3.13.10](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.10.md) | Dec 2, 2025 | 3.13.10 | High | 3 | 0 |
| [Python 3.13 3.13.6](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.6.md) | Aug 6, 2025 | 3.13.6 | High | 1 | 0 |
| [Python 3.13 3.13.4](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.4.md) | Jun 3, 2025 | 3.13.4 | High | 6 | 0 |
| [Python 3.13 3.13.2](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.2.md) | Feb 4, 2025 | 3.13.2 | High | 2 | 0 |
| [Python 3.13 3.13.1](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.1.md) | Dec 3, 2024 | 3.13.1 | High | 5 | 0 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.