Python 3.10.22, 3.11.17, 3.12.15, 3.13.16 and 3.14.8 are now available!

Core Development
1

A full sweep of Python releases is here: Python 3.10.22, 3.11.17, 3.12.15, 3.13.16 and 3.14.8 are now available! One last lap around the Sun for Python 3.10, and security updates across all five series.

Get them here:

Python 3.10.22 is the final release of Python 3.10. After five years, the series has reached end of life and will receive no further security updates. If you are still using Python 3.10, please plan your upgrade to a supported version.

Python 3.11 remains in security-fix-only mode until October 2027, as described in PEP 664. Security releases are made as needed, with no fixed cadence.

Python 3.10.22 and 3.11.17 are source-only. There are no Windows or macOS installers: 3.10.11 and 3.11.9 were the last releases in their respective series to include binary installers. These two releases contain security fixes rather than new features.

Python 3.12.15 is also a source-only security release, with security support continuing until October 2028. Python 3.13.16 is the last full maintenance release of 3.13; future 3.13 releases will contain security fixes only. Python 3.14.8 is a maintenance release, and both 3.13.16 and 3.14.8 include binary installers. See their release pages above for their full security content and other changes.

Security content in all five releases

  • gh-158446: Fix crashes or incorrect output when formatting float or complex values with precision close to INT_MAX.
  • CVE-2026-19553 — gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname, and session arguments. asyncio also validates TLS server_hostname arguments. On Python 3.10, 3.11, and 3.12, missing hostnames with check_hostname enabled emit DeprecationWarning for compatibility; they raise ValueError on Python 3.13 and later.
  • CVE-2026-82049 — gh-157190: Fix a tarfile extraction-filter vulnerability involving hard links to symbolic links that could expose files outside the destination and change their permissions or modification times.
  • gh-157953: Update bundled libexpat to version 2.8.5.
  • CVE-2026-15310 — gh-156002: Bound zipfile decompression per read for bzip2 and LZMA members, and for Zstandard members on Python 3.14, preventing unbounded allocations from small compressed members. Third-party decompressors supplied by monkey-patching _get_decompressor() that lack needs_input and two-argument decompress() remain vulnerable.
  • CVE-2026-19672 — gh-155999: Prevent tarfile extraction filters from creating directories outside the destination for paths that leave it and then return.
  • CVE-2026-19445 — gh-156293: Fix an ssl crash when an SNI callback switches contexts and the original callback context is no longer referenced.
  • CVE-2026-17084 — gh-155292: Restrict stringprep and the IDNA codec to Unicode codepoint attributes defined by RFC 3454.
  • CVE-2026-15806 — gh-155694: Scope urllib.request HTTPPasswordMgr credentials by URL scheme to prevent HTTPS credentials from being used for matching HTTP URLs.

Additional security content by version

Python 3.10.22, 3.11.17, 3.12.15 and 3.13.16

  • CVE-2026-87910 — gh-157265: Apply tarfile extraction filters when a link falls back to extracting an archive member, skipping members rejected by the filter.

Python 3.13.16 and 3.14.8

  • gh-158010: Update bundled OpenSSL to 3.5.9. In Python 3.13.16 this applies to Windows, macOS and Android, moving from OpenSSL 3.0.21 to the 3.5 LTS series. In Python 3.14.8 it applies to Windows, macOS, Android and iOS. The source-only Python 3.10–3.12 releases do not bundle OpenSSL.

Python 3.10.22

  • gh-149018: Improve protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when compiled with libexpat 2.8.0 or later.

This XML hash-flooding protection was already included in Python 3.11.16.

For the full details, see the 3.10.22 changelog, 3.11.17 changelog, 3.12.15 changelog, 3.13.16 changelog, and 3.14.8 changelog.

And now for something completely different

When two black holes merge, the newly formed black hole is distorted. It settles towards a stationary state by emitting gravitational waves in a process called ringdown. Like a struck bell, it oscillates with a signal that fades away. These oscillations are described by quasinormal modes; their frequencies and decay times depend on the final black hole’s mass and spin. You can watch spacetime doing its final ringing in this NASA simulation.

We started Python 3.10 with a trip inside a Schwarzschild black hole, so it seems only fair to finish with black holes as well :slight_smile:

This is Python 3.10’s ringdown. One last release before we switch off the release machinery. Five years of features, fixes, stubborn buildbots, and a rather unreasonable number of tarballs. I cannot quite believe I am writing the last one.

Thank you to everyone who contributed patches, reviewed changes, tested releases, reported bugs, or helped us get a release out when the universe seemed determined to prevent it. It has been a privilege to be your release manager for this series.

Python 3.11 still has another year of security fixes ahead of it, so you have not escaped me yet :slight_smile:

We hope you enjoy the new releases!

Thank you to all the volunteers who made these releases possible. Please consider supporting Python by contributing your time or through the Python Software Foundation.

Your friendly release team,
Hugo van Kemenade
Thomas Wouters
Pablo Galindo Salgado

28 Likes
3

Wow. I had no idea y’all maintained the last five versions, It has got to be exhausting to keep up with all changes. Nice job.

1 Like
4

Worth pointing out that not all those releases are normal bugfix releases. 3.10-3.12 were security releases (3.10 is now EOL). 3.13 and newer are still getting bug fixes.

1 Like
5

Note, this was the last 3.13 bug fix release. It will be security-only from now on.

1 Like
6

The ci-images have all been updated, including dropping Python 3.10 from the list[1].

  1. I think this is the first time the automation encountered an EOL version, and I’m happy and mildly surprised it all worked flawlessly :laughing: ↩︎

1 Like
7

Attention macOS 27.0 IDLE or tkinter users

When running IDLE or other GUI applications that use the tkinter module, these applications may hang when using an application’s menu command that opens a dialog (for example, IDLE’s About IDLE, Settings, and Open Module commands) resulting in a spinning beach ball with Force Quit needed.

This problem is due to an operating system behavior change in macOS 27.0 that is believed to affect all current versions of the Tk graphics toolkit and thus the tkinter module in all current Python versions.

If you depend on Tk-based applications (like IDLE) on macOS, you may want to consider deferring installing macOS 27.0 until a Tk or macOS workaround is available or testing that your application workflow is not affected. Follow issue #158053 for updates.

1 Like
8

And as such, this is the final WASI build for 3.13!

2 Likes
9

Oh well, wrong subsections order in the changelog again (at least for 3.13)

10

Another question is why these security issues are not mentioned in proper changelogs on https://docs.python.org/3.*/whatsnew/changelog.html (for example, except for 3.13.8, none of them mentions gh-157190). And why (mostly) there are no CVE links.

11

I guess not all RMs are on the latest blurb 2.1.0. We can add a version check to the scripts: Require blurb >= 2.10 · Issue #450 · python/release-tools · GitHub.

12

Specifically about gh-157190, it is in the changelogs for 3.10-3.13:

It’s not in 3.14 because 3.14+ aren’t vulnerable, as mentioned at gh-157190:

This was incidentally fixed by 5a57248 for 3.14+ which changed os.link to use AT_SYMLINK_FOLLOW.

And CVE-2026-82049:

In CPython 3.13 and earlier, the tarfile module’s data and tar extraction filters are vulnerable…

affected

  • affected from 0 before 3.10.22
  • affected from 3.11.0 before 3.11.17
  • affected from 3.12.0 before 3.12.15
  • affected from 3.13.0 before 3.13.16
  • affected from 3.14.0a1 before 3.14.0b1

I’ve updated python.org/downloads/release/python-3148/ and opened python/python-insider-blog#155 to fix the blog post.

13

And as far as I can see, all the other announced security fixes are included in the matching changelogs. Please can you point to any specific omissions?

Generally because the NEWS file that goes into the changelog is written at PR time and CVE assignments come later.

14

OK, it is only gh-157190 (aka CVE-2026-82049).

16

Actually, changelog for 3.14.8 also doesn’t mention the fix for gh#python/cpython#157265, which is reported to be fixed everywhere else, and gh#python/cpython!157307 seems to be also part of the 3.14 branch (commit a4919937a4e).

Although, when I switch to 3.14 branch, grep -r 'gh-157265' . returns lovely nothing.

Something’s wrong.

17

I don’t think anything’s wrong here.

Issue gh-157265 is only listed in thr announcement for 3.10-3.13, and the 3.14 backport GH-157307 was merged as a491993 about 15 hours after Python 3.14.8 was tagged, so isn’t part of that release.

$ git log -1 --date=iso-strict-local --format='%cd  %s' v3.14.8
2026-09-30T19:55:09+02:00  Python 3.14.8

$ git log -1 --date=iso-strict-local --format='%cd  %s' a491993
2026-10-01T11:39:09+02:00  [3.14] gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) (#157307)

$ git merge-base --is-ancestor a491993 v3.14.8

$

The fix is now merged in the branch, but “gh-157265” only appears in rendered changelogs.

You can see it listed under “Python next, Release date: XXXX-XX-XX” (and not under Python 3.14.8 final, Release date: 2026-09-30").

And grep didn’t find it because the issue number exists in the filename of unreleased news fragments, not the body:

$ ls Misc/NEWS.d/next/Security/*157265*
Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst