Python 3.15.2 and four other releases block eMudhra keys in ssl

Python 3.15.2 and four other releases block eMudhra keys in ssl

26 October 2026: The Python core team has published expedited security releases for every supported line, 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18, that make the ssl module refuse the compromised eMudhra intermediate CA keys (CVE-2026-115557). The team calls the block a last resort against their use, and says it makes normal use of pip safe from attacks built on those keys, including upgrading pip itself, even before pip is updated.

Not yet independently verified. The release notes are the Python core team's own post; we did not open the individual changelogs or GitHub issues, and the post gives no severity scores. We will update this when it can be confirmed, and remove this note.

That closes the gap our earlier item on Python 3.15.1 and pip 26.2.2 left open: there the fix lived in pip, so every virtual environment had to be upgraded one by one. Because the block now sits in the interpreter, it also covers the standard library's own HTTPS clients, urllib.request and http.client, and third-party code that verifies certificates through the ssl module, without any change to the application.

Security fixes in all five releases

• CVE-2026-115557 (gh-160040): distrust the compromised eMudhra intermediate CA keys
• CVE-2026-114583 (gh-160097): reject links that replace the destination in tarfile.tar_filter, the filter meant to make extracting untrusted archives safe
• gh-160300: reject cookies with a negative version in http.cookiejar

The tarfile fix matters to anyone who adopted the extraction filters to unpack archives from users or package feeds, since a link that swaps out the destination is exactly what those filters exist to stop.

Extra fixes on the older lines

Python 3.13.18, 3.12.16 and 3.11.18 also pick up fixes already shipped in 3.15.1 and 3.14.9: the bundled Expat updated to 2.9.0 (CVE-2026-77214 and CVE-2026-102633), CVE-2024-3220, under which Windows no longer reads mimetypes.knownfiles by default, and another header refolding-quoting edge case (gh-87720). The 3.13.18 and 3.12.16 releases also fix a race in the cleanup of tempfile.TemporaryDirectory (gh-157579).

Installers and source-only releases

Only 3.15.2 and 3.14.10 come with binary installers. The 3.13.18, 3.12.16 and 3.11.18 releases are source-only security releases, so teams on those lines get them through their Linux distribution, a container base image or their own build, and should check when those channels pick them up.

The eMudhra key compromise behind this release is set out in our news item on the revoked intermediates. The team's advice is to upgrade every affected version.

Sources

• Python Insider: Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out, 26 October 2026