Python Ships Tarfile, SSL and Zipfile Security Fixes Across Five Branches and Retires 3.10 With Its Final Release

Overview

The Python core team has published a coordinated set of releases covering every branch from 3.10 to 3.14: 3.10.22, 3.11.17, 3.12.15, 3.13.16 and 3.14.8, according to the Python Insider announcement. Each carries fixes for numbered CVEs in the standard library, spanning the ssl, tarfile, zipfile, urllib.request and stringprep components, and the release also marks the end of life of Python 3.10.

What Was Released

The Python.org release page for 3.14.8 lists a release date of Sept. 30, 2026 and describes 3.14.8 as “an expedited security release and the eighth maintenance release of 3.14,” with around 354 bugfixes, build improvements and documentation changes from 142 contributors since 3.14.7. The Python Insider post, by contrast, characterizes 3.14.8 as “a maintenance release.”

The other branches break down as follows, per Python Insider:

• Python 3.13.16 is “the last full maintenance release of 3.13”; future 3.13 releases will contain security fixes only. The Python.org’s 3.13.16 release page says it contains around 290 bugfixes, build improvements and documentation changes since 3.13.15.
• Python 3.12.15 is a source-only security release, with security support continuing until October 2028.
• Python 3.11.17 is source-only, and Python 3.11 remains in security-fix-only mode until October 2027.
• Python 3.10.22 is the final release of Python 3.10. In the post’s words, “After five years, the series has reached end of life and will receive no further security updates.”

The post adds that there are no Windows or macOS installers for 3.10.22 and 3.11.17, since 3.10.11 and 3.11.9 were the last releases in their respective series to include binary installers. Both 3.13.16 and 3.14.8 include binary installers.

The Security Fixes

The Python.org release page for 3.14.8 lists seven CVEs for 3.14.8, and the Python.org’s 3.13.16 release page and Python.org’s 3.12.15 release page list the same seven, with 3.12.15 adding an eighth. Descriptions below follow the wording of the Python Insider announcement unless noted.

Tarfile. Three of the fixes concern extraction filters, the mechanism meant to constrain what an archive can write to disk:

• CVE-2026-82049 (gh-157190) fixes a vulnerability involving hard links to symbolic links that “could expose files outside the destination and change their permissions or modification times,” according to Python Insider.
• CVE-2026-19672 (gh-155999) prevents extraction filters “from creating directories outside the destination for paths that leave it and then return,” per Python Insider.
• CVE-2026-87910 (gh-157265) applies extraction filters when a link falls back to extracting an archive member, skipping members the filter rejects. Per Python Insider, this fix is listed for 3.10.22, 3.11.17, 3.12.15 and 3.13.16 as additional security content; the Python.org’s 3.12.15 release page describes it as “tarfile hardlink fallback ignores custom extraction filter rejection via None.” It does not appear in the 3.14.8 list on the Python.org release page for 3.14.8.

SSL. Two fixes touch the ssl module:

• CVE-2026-19445 (gh-156293) fixes an ssl crash when an SNI callback switches contexts and the original callback context is no longer referenced, according to Python Insider. The Python.org release page for 3.14.8 labels the issue a “Use-after-free of a server-side SSLContext when sni_callback switches contexts.”
• CVE-2026-19553 (gh-156793) makes ssl.SSLContext.wrap_bio() validate its server_side, server_hostname and session arguments, and asyncio now validates TLS server_hostname arguments, per Python Insider. The post notes a compatibility wrinkle: on Python 3.10, 3.11 and 3.12, missing hostnames with check_hostname enabled emit a DeprecationWarning, while on 3.13 and later they raise ValueError.

Zipfile. CVE-2026-15310 (gh-156002) bounds zipfile decompression per read for bzip2 and LZMA members, and for Zstandard members on Python 3.14, “preventing unbounded allocations from small compressed members,” according to Python Insider. The post cautions that third-party decompressors supplied by monkey-patching _get_decompressor() that lack needs_input and two-argument decompress() remain vulnerable.

urllib and stringprep. CVE-2026-15806 (gh-155694) scopes urllib.request HTTPPasswordMgr credentials by URL scheme “to prevent HTTPS credentials from being used for matching HTTP URLs,” per Python Insider. CVE-2026-17084 (gh-155292) restricts stringprep and the IDNA codec to Unicode codepoint attributes defined by RFC 3454, according to Python Insider.

Other hardening. The post lists gh-158446, which fixes crashes or incorrect output when formatting float or complex values with precision close to INT_MAX, and gh-157953, which updates bundled libexpat to version 2.8.5. For the binary-installer releases, gh-158010 updates bundled OpenSSL to 3.5.9: in 3.13.16 it applies to Windows, macOS and Android and moves from OpenSSL 3.0.21 to the 3.5 LTS series, while in 3.14.8 it applies to Windows, macOS, Android and iOS, per Python Insider. The source-only 3.10 to 3.12 releases do not bundle OpenSSL.

What We Don’t Know

• The sources reviewed list CVE identifiers and one-line descriptions but do not state severity scores or whether any of the flaws has been exploited in the wild.
• The Python.org page labels 3.14.8 an “expedited security release,” but neither it nor the announcement explains what prompted the accelerated timing.
• The announcement does not say how many installations still run Python 3.10, which now receives no further security updates.

Context

Python 3.15 is on a separate track from these maintenance branches; The Machine Herald previously reported on it entering the release candidate phase. For teams on 3.10, the practical upshot per the announcement is that the series is closed: the post asks anyone still using it to “plan your upgrade to a supported version.”