Python 3.15.2, 3.14.10 and older: eMudhra and tarfile fixes

As of October 27, 2026, 03:40 JST (October 26, 18:40 UTC). Every fact that can change carries the time it was checked, in JST (UTC+9).

Install Python 3.15.2 or 3.14.10, or on the security-only branches 3.13.18, 3.12.16, or 3.11.18. They make the ssl module reject the compromised eMudhra keys (CVE-2026-115557) and fix a bypass of tarfile's tar filter (CVE-2026-114583). Only 3.15.2 and 3.14.10 have python.org installers.

The other three are source only. python.org's release pages date all five October 25, and its blog announced them on October 26. In the announcement's words, the eMudhra keys "are now blocked by the ssl module as a last resort against their use", and "Normal uses of pip, including to upgrade pip itself, are now safe from attacks based on those compromised keys" even if pip hasn't been updated yet. The Python Software Foundation scores the ssl CVE 9.4 (CVSS 4.0, Critical) and the tarfile CVE 6.9 (Medium) in the CVE records (checked 03:27 JST).

Below: which version to install for each branch, what each fix does, where the new versions are available beyond python.org, and the update steps.

Which version to install

From the Python blog post and python.org's downloads page (checked 03:15 and 03:31 JST).

The 3.13.18 release page says "Python 3.13.17 was the last bugfix release with binary installers" (checked 03:33 JST). So on a Mac or Windows PC that runs a python.org installer of 3.13, the fixed 3.13 needs a build from source or another distribution. Moving to 3.14.10 is the other way.

The two CVEs

CVE-2026-115557, the eMudhra keys (gh-160040). In October, eight eMudhra intermediate certificates turned out to have private keys that anyone could recover, and browsers blocked them within days (Chrome's eMudhra root removal on October 27: what to do). Python's CVE record: "Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration." The issue that proposed it says the check matches each key's SubjectPublicKeyInfo, "so cross-signed certs that reuse a key are blocked, too", and that it runs when verification is on (CERT_OPTIONAL or CERT_REQUIRED); CERT_NONE is unaffected.

The previous round, Python 3.15.1, 3.14.9, and 3.13.17 on October 21, took a different route: it bundled pip 26.2.2, which includes certifi 2026.10.19 "to address the eMudhra / emSign CA certificate security incident" (Python blog, October 21). That fixes the certificate list pip uses. The denylist in this round works inside ssl itself, for every program, whatever certificate list it loads.

CVE-2026-114583, tarfile (gh-160097). The CVE record: "tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory." A malicious archive could make extractall() with filter="tar" write outside the destination. The record calls it "the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter." Since Python 3.14 the default filter is data, per the tarfile docs, so the bug matters most for code that passes filter="tar" and extracts archives from someone else.

The third fix, gh-160300, makes http.cookiejar reject cookies with a negative version. It has no CVE.

Where else the new versions are

Python in a Linux distribution's own packages gets the fix when that distribution backports it; this page didn't check each one.

On macOS, Apple's python3 is separate

The python3 that comes with macOS or the Xcode Command Line Tools isn't a python.org build, and these releases don't update it. Apple's support page about the eMudhra intermediates, published October 23, says some command-line tools included with macOS, among them curl, git, python3, ruby, perl, and openssl, check certificates against /etc/ssl/cert.pem, and for certificates chaining to a root in that file they "can still accept these certificates." Apple says the fix comes "in a future software update", with no date, and gives an optional interim edit of that file for administrators (checked 03:30 JST). Details are in the Chrome eMudhra post.

Update Python

1. Find every Python you run

Run python3 --version and which -a python3, and in each virtual environment python --version. Check the base images of your containers (docker run --rm <image> python --version) and the Python versions your CI installs.

2. Install the fixed version for your branch

For 3.15 and 3.14, download the installer from python.org, or use pyenv, Homebrew, or uv as in the table. For 3.13, 3.12, and 3.11, use a channel that builds from source (pyenv, Homebrew, uv, Docker), build from the source tarball, or move to 3.14.10.

3. Recreate virtual environments

A virtual environment points at the interpreter it was made with. After a patch update within the same branch, python -m venv --upgrade <dir> updates it in place; a move to a new branch, such as 3.13 to 3.14, needs a new environment and a reinstall of your packages.

4. Rebuild images and restart

Rebuild container images from the updated base, redeploy, and restart long-running Python processes, which keep the old interpreter until they restart.

5. Check the new version

Run python -c "import sys; print(sys.version)" in each place. It should print 3.15.2, 3.14.10, 3.13.18, 3.12.16, or 3.11.18.

Updates to this page

• October 27, 2026, 03:40 JST: first version. Sources read between 03:15 and 03:40 JST.

This page changes when Homebrew's python@3.15 moves to 3.15.2, when Apple ships the macOS update for /etc/ssl/cert.pem, and when Python publishes another security release. The same week: Chrome's eMudhra root removal on October 27: what to do, Brotli CVE-2026-111497 fixes for .NET, Python, PHP, and Ruby, Pillow CVE-2026-112398 and 13.0.0: what to update, and LiteLLM 1.107.0 compromised on PyPI and Docker: what to do.

Frequently asked questions

Which Python version should I install in October 2026?

3.14.10 or 3.15.2, both with python.org installers, or 3.13.18, 3.12.16, or 3.11.18 if you stay on a security-only branch. All five came out on October 25, 2026, and fix CVE-2026-115557 and CVE-2026-114583.

Is there a Windows or macOS installer for Python 3.13.18?

No. 3.13.18, 3.12.16, and 3.11.18 are source only; python.org's 3.13.18 page says 3.13.17 was the last 3.13 release with binary installers. Use pyenv, Homebrew, uv, or a Docker image, build from source, or move to 3.14.10.

Do I still need to update certifi or pip for eMudhra?

Updating doesn't hurt, but Python's announcement says normal uses of pip are now safe from attacks based on those keys "even if pip hasn't been updated yet", because the ssl module blocks the keys itself. Programs that load their own certificate list get the block too: the CVE record says the keys are rejected "regardless of the SSLContext policy configuration."

Is Python 3.10 getting the eMudhra fix?

No. Python 3.10 reached end of life on October 1, 2026, per python.org's downloads page, and its last release is 3.10.22 from the same day. Move to 3.11.18 or later.

Am I affected by the tarfile CVE-2026-114583?

Only if your code extracts archives from someone else with filter="tar". The bug let crafted link entries send later files outside the destination. Since Python 3.14 the default filter is data, which this CVE doesn't cover; its data counterpart was CVE-2026-7774.

Does this fix the Brotli vulnerability in Python?

No. These releases don't mention Brotli. CVE-2026-111497 is fixed in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0: Brotli CVE-2026-111497 fixes for .NET, Python, PHP, and Ruby.

Sources

Times are when this page read each source, in JST on October 27, 2026.

• Python Insider: Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out, October 26, 2026 (03:15)
• Python Insider: Python 3.15.1, 3.14.9 and 3.13.17 are out, October 21, 2026 (03:33)
• python.org: Downloads, Python 3.14.10, and Python 3.13.18 (03:31, 03:33)
• CVE.org: CVE-2026-115557 and CVE-2026-114583 (03:27)
• CPython issue gh-160040: ssl: distrust compromised eMudhra intermediate CA keys (03:33)
• Python docs: tarfile, extraction filters (03:38)
• pyenv releases and its python-build definitions (03:35)
• Homebrew: python@3.14, python@3.15, and the homebrew-core formulas (03:36)
• python-build-standalone releases (03:34)
• docker-library/python commits (03:34)
• Apple Support: About the compromised eMudhra intermediate CAs, October 23, 2026 (03:30)