ReleaseBytes
python Python Insider · · 3.12.14

Python 3.12.14, 3.11.16, and 3.10.21 Released with Critical Security Patches

blogsecuritysecurity-advisoryengineer
security patch announcement

The Python core development team has released security updates for Python versions 3.12.14, 3.11.16, and 3.10.21. These patch releases primarily address numerous security vulnerabilities, including path traversal bypasses, denial-of-service risks, and HTTP header injection flaws across various modules like `tarfile`, `http.client`, `zipfile`, and `csv`. Users are strongly encouraged to upgrade immediately to mitigate potential security exposures, as these versions are now in security-fix-only mode. Additional minor bug fixes are also included for specific versions.

Security (1) ›
  • Multiple Security Vulnerabilities Patched Across Core Modules

    These releases fix numerous security issues, including path traversal bypasses in `tarfile` and `zipfile`, denial-of-service vulnerabilities in `csv`, `expat`, `unicode`, and `configparser`, and HTTP header injection risks in `http.client`. Other fixes address issues in `ftplib`, `xml.parsers.expat`, and `asyncio`, along with several CVEs like CVE 2026-2297, CVE 2026-4224, and CVE 2026-3644.

Read the original announcement →

https://blog.python.org/2026/08/python-31214-31116-31021/

Related releases