macOS · Python Software Foundation
Python3 security updates
The latest version of Python3 is 3.13.13, released April 7, 2026. Patch Radar has 0 security fixes for Python3, closing 0 CVEs. 33 CVEs have no fix yet.
33 with no fix yet
Latest version
3.13.13
Released Apr 7, 2026
Security fixes
0
On record in Patch Radar
CVEs
0
Closed by those fixes
Exploited
0
Vendor report or CISA KEV
CVEs with no fix yet
| Priority | CVE | Title | Status |
|---|---|---|---|
| Urgent | CVE-2026-115557 | Distrust compromised intermediate certificates in ssl module | no-fix |
| Urgent | CVE-2026-19445 | Use-after-free of a server-side SSLContext when sni_callback switches contexts | no-fix |
| High | CVE-2025-15366 | IMAP command injection in user-controlled commands | no-fix |
| High | CVE-2025-15367 | POP3 command injection in user-controlled commands | no-fix |
| High | CVE-2026-11940 | tarfile extraction filter bypass allows escaping the destination directory | no-fix |
| High | CVE-2026-11972 | tarfile opened in streaming mode mishandles EOF | no-fix |
| High | CVE-2026-15308 | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | no-fix |
| High | CVE-2026-19553 | SSLContext.wrap_bio() missing validation of server_hostname parameter | no-fix |
| High | CVE-2026-3298 | Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes | no-fix |
| High | CVE-2026-4786 | Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() | no-fix |
| High | CVE-2026-6100 | Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure | no-fix |
| High | CVE-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | no-fix |
| High | CVE-2026-82049 | tarfile extraction filters allow file modification and content disclosure via hard link to symlink | no-fix |
| High | CVE-2026-9669 | bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow | no-fix |
| Routine | CVE-2024-3220 | Default mimetype known files writeable on Windows | no-fix |
| Routine | CVE-2026-0864 | Configuration Injection via Carriage Return (\r) in write() method | no-fix |
| Routine | CVE-2026-103995 | Lenient parsing of integers for response body and chunk framing | no-fix |
| Routine | CVE-2026-114583 | tar filter allows writing outside destination via empty-named symlink | no-fix |
| Routine | CVE-2026-116566 | socket.getaddrinfo() accepts embedded null bytes in host and port | no-fix |
| Routine | CVE-2026-12003 | CPython >3.11 Insecure Input Validation resulting in privilege escalation | no-fix |
| Routine | CVE-2026-12345 | Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory | no-fix |
| Routine | CVE-2026-1502 | HTTP client proxy tunnel headers not validated for CR/LF | no-fix |
| Routine | CVE-2026-15310 | zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits | no-fix |
| Routine | CVE-2026-15806 | `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | no-fix |
| Routine | CVE-2026-17084 | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | no-fix |
| Routine | CVE-2026-18503 | Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() | no-fix |
| Routine | CVE-2026-19672 | tarfile extraction filter bypass allows creation of directories outside the destination | no-fix |
| Routine | CVE-2026-3276 | Potential DoS via quadratic complexity in unicodedata.normalize() | no-fix |
| Routine | CVE-2026-6019 | BaseCookie.js_output() does not neutralize embedded characters | no-fix |
| Routine | CVE-2026-6879 | Quadratic Behavior in xml.etree.ElementPath Index Predicates | no-fix |
| Routine | CVE-2026-7774 | tarfile.data_filter path traversal bypass allows writing outside the extraction directory | no-fix |
| Routine | CVE-2026-8328 | FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address | no-fix |
| Routine | CVE-2026-87910 | tarfile hardlink fallback ignores custom extraction filter rejection via None | no-fix |