Python Security Releases Block Compromised eMudhra CA Keys

Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 security releases #

The Python Insider security release post states that these releases address the compromised eMudhra intermediate CA keys. The notes list that item as CVE-2026-115557 under gh-160040, together with CVE-2026-114583 and gh-160300, under security content in all five releases. Because the same three items appear in every branch, a single upgrade policy can cover all five branches.

Blocking the compromised eMudhra intermediate CA keys #

"These keys are now blocked by the ssl module as a last resort against their use."

Python Insider security release post

The block is applied in the ssl module, so any application that verifies TLS connections through the standard library is affected by the upgrade. This suggests that TLS connections whose certificate chains rely on those keys may fail after upgrading, although the sources do not describe the resulting errors. Teams should test certificate verification against their real endpoints before rolling out the upgrade.

Pip after the eMudhra change #

The post says that normal uses of pip, including upgrading pip itself, are now safe from attacks based on those keys, even if pip has not been updated yet. This means the interpreter upgrade alone protects pip operations against those keys. This suggests that a separate pip update can be scheduled independently, but the sources do not describe a pip release plan.

Installer availability by branch #

Python 3.15.2 and 3.14.10 come with binary installers. Python 3.13.18, 3.12.16 and 3.11.18 are source-only security releases, so teams on those branches must build the interpreter or obtain builds through their own channels. Deployments that depend on prebuilt installers for those branches should confirm their build pipeline before the rollout.

Tar extraction and cookie parsing #

CVE-2026-114583 under gh-160097 rejects links that replace the destination in tarfile.tar_filter. Code that extracts archives through that filter will see stricter behaviour after the upgrade, so extraction should be re-tested with archives that contain links. gh-160300 rejects cookies with a negative version in http.cookiejar. The notes list no CVE identifier for this item, so services that accept cookies from external clients should test their cookie handling directly.

Python 3.13.18, 3.12.16 and 3.11.18 additional security content #

The post lists the following items under the 3.13.18, 3.12.16 and 3.11.18 releases, and states that these fixes were already included in Python 3.15.1 and 3.14.9. The sources do not describe how the changes reached each branch, so each change below is reported only under the releases whose notes list it.

Bundled Expat updated to 2.9.0 #

The notes list CVE-2026-77214 and CVE-2026-102633 under gh-158876 for updating the bundled Expat to 2.9.0. Code that parses XML through the bundled library should be tested on the rebuilt source-only interpreter. The sources do not state whether other Expat builds are affected.

Windows default for mimetypes.knownfiles #

CVE-2024-3220 under gh-159428 stops Python from reading mimetypes.knownfiles by default on Windows. Windows deployments that rely on custom MIME type files should check whether they depend on those files and verify MIME lookups after upgrading.

Header refolding-quoting edge case #

gh-87720 fixes an additional header refolding-quoting edge case. The notes name only the item and its number, so this article cannot describe the behaviour change. Code that builds or folds email headers should be included in the regression tests after the upgrade.

TemporaryDirectory cleanup race condition #

gh-157579 fixes a race condition in the cleanup of tempfile.TemporaryDirectory, and the notes list it under 3.13.18 and 3.12.16 only. The notes say this fix was already included in Python 3.15.0 and 3.14.9. Services that create and delete temporary directories concurrently on those two branches should schedule this upgrade early.

Python 3.15.0 final release notes #

The Python 3.15.0 (final) announcement, dated 2026-10-09, lists the 3.15 language changes: PEP 661 for a sentinel built-in type, PEP 686 for UTF-8 as the default encoding, PEP 798 for unpacking in comprehensions, PEP 810 for explicit lazy imports, PEP 814 for a frozendict built-in type, and PEP 829 for package startup configuration files. The UTF-8 default is the change most likely to need checks in existing code, because it changes the encoding that code receives by default. This suggests that code which reads files without an explicit encoding should be reviewed.

Typing and C API changes in 3.15.0 #

The release also lists typing features PEP 728 (TypedDict with typed extra items), PEP 747 (TypeForm) and PEP 800 (disjoint bases in the type system). On the C API side it lists PEP 782 for a new PyBytesWriter, PEP 788 for protection against finalization, and PEP 803, 820 and 793 for stable ABI for free-threaded builds. Extension authors should review the C API items against their build setup.

Experimental JIT figures in 3.15.0 #

The post states that the experimental JIT compiler has been significantly upgraded, with a 7-8% geometric mean performance improvement on x86-64 Linux over the standard interpreter. A second figure, an 11-12% speedup on AArch64 macOS, is measured against the tail-calling interpreter. The two figures use different platforms and baselines, so they should not be combined. Teams should measure their own workloads on their target platform.

Profiling and error message improvements in 3.15.0 #

The standard library changes include PEP 799 for a dedicated profiling package, and the Tachyon high-frequency statistical sampling profiler, which the post also lists under PEP 799. The release also lists improved error messages. Teams that profile services can evaluate Tachyon alongside their current profiling tools.

Build and binary changes in 3.15.0 #

PEP 831 enables frame pointers by default for improved system-level observability. The official Windows 64-bit binaries now use the tail-calling interpreter, and the official macOS binaries now install free-threading support by default. Teams that pin binary builds should check these defaults after installing 3.15.0.

IDLE and tkinter hang on macOS 27.0 #

The post warns that IDLE or other tkinter applications may hang on macOS 27.0 when a menu command opens a dialog, such as IDLE's About IDLE, Settings and Open Module commands. The cause is linked to an operating system behaviour change that is believed to affect all current versions of the Tk graphics toolkit. Users who depend on Tk-based tools should defer installing macOS 27.0 until a workaround is available, or test their workflow first. Updates are tracked in issue #158053.

Upgrade checklist for each affected branch #

1. Identify every Python installation by branch: 3.15.x, 3.14.x, 3.13.x, 3.12.x and 3.11.x.

2. Upgrade 3.15 installs to 3.15.2 and 3.14 installs to 3.14.10, using the binary installers listed for those versions.

3. Upgrade 3.13, 3.12 and 3.11 installs to 3.13.18, 3.12.16 and 3.11.18, rebuilding from source because these releases are source-only.

4. Test certificate verification through the ssl module against your real TLS endpoints after the upgrade.

5. Confirm that pip works after the interpreter upgrade, and schedule a separate pip update if your process needs one.

6. Re-test archive extraction that uses tarfile.tar_filter, and cookie handling that uses http.cookiejar.

7. On Windows, check any reliance on mimetypes.knownfiles, and on 3.13.18 and 3.12.16 verify code that cleans up TemporaryDirectory instances concurrently.

8. Before adopting 3.15.0, review the PEP changes for the default UTF-8 encoding, the C API and the free-threading defaults on macOS.

9. If you use IDLE or tkinter on macOS, test the workflow before installing macOS 27.0, or defer the install until a workaround is available.