Five Python versions in one day: an expedited security release
Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are expedited security releases that block the compromised eMudhra CA keys in ssl and close a tarfile flaw.
What happened?
The Python team shipped expedited security releases for five branches at once: 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18.
The release pages on python.org are dated October 25, and the release team's announcement landed on October 26. The release is expedited because its cause is a set of compromised certificate keys, and a cause like that does not wait for the normal release cycle. On its own, 3.15.2 carries around 130 bugfixes from 70 contributors since 3.15.1.
Why are the certificates the story?
Compromised intermediate CA keys from a certificate authority called eMudhra are now blocked by the ssl module itself, in the fix for CVE-2026-115557.
The team describes the block as a last resort against the use of those keys. The practical result matters more than the wording: normal uses of pip, including upgrading pip itself, are now safe from attacks based on those compromised keys, even if pip has not been updated yet.
The eMudhra story passed through here before, in the MongoDB Compass article, and now its effect has reached the core of Python.
What does each branch get?
All five releases share the same three security fixes, and the older branches get extras that had already reached the newer lines.
CVE-2026-115557: distrust of the compromised eMudhra keys, in all five releases.
CVE-2026-114583: links that replace the extraction destination in
tarfile.tar_filterare rejected, in all five releases.A fix in
http.cookiejar: cookies with a negative version are rejected, in all five releases.In 3.13.18, 3.12.16 and 3.11.18, extra: the bundled Expat update to 2.9.0 (CVE-2026-77214 and CVE-2026-102633), and the CVE-2024-3220 fix that stops reading
mimetypes.knownfilesby default on Windows.
Those extras were already in 3.15.1 and 3.14.9, and now they have reached the older branches.
What should you do now?
Upgrade to the latest release of your branch. Binary installers exist only for 3.15.2 and 3.14.10; the rest are built from source.
The release team writes that upgrading is highly recommended to all users of affected versions. If your branch is 3.13 or older and you have no ready installer, build from source, or move up to 3.14 or 3.15 if your project can take the step.
And if your project pulls outside packages every day, the LiteLLM compromise article stays the closest reminder. If you want a security check for your own platform before it grows, Muhassan is built for that.
FAQ
Why is this release expedited?
Because compromised intermediate CA keys from eMudhra had to be blocked fast. The ssl module now rejects them, so even normal pip use is safe before pip itself updates.
Which versions come with binary installers?
Only 3.15.2 and 3.14.10. Python 3.13.18, 3.12.16 and 3.11.18 are source-only security releases, with no installers.
What is the tarfile flaw?
CVE-2026-114583: links in tarfile archives that replace the extraction destination. These releases reject such links.
I am on 3.13 or older. What extra fixes do I get?
The bundled Expat update to 2.9.0 carries CVE-2026-77214 and CVE-2026-102633, plus the CVE-2024-3220 fix on Windows, and a temp directory cleanup race fixed in 3.13.18 and 3.12.16.
