Python Releases 3.12.14, 3.11.16, and 3.10.21 to Patch tarfile Bypasses and DoS Vectors
Python's core development team has dropped security-only updates for three active releases: Python 3.12.14, Python 3.11.16, and Python 3.10.21. Thomas Wouters, a Python core developer, announced the batch on August 12, 2026. The timing seems to have caught some attention, as Wouters noted the release coincided with a solar eclipse visible across Europe. If you're looking for a celestial bookmark for when you roll this out, the sky provided one.
These are source-only releases. All three versions are now in security-fix-only maintenance mode with no pre-set release cadence, meaning you grab these when the team ships patches rather than on a schedule. The updates address path traversal bypasses in tarfile, remote code execution vectors via web browsers, denial-of-service flaws in XML and CSV parsing, and several memory safety issues.
Archive Safety and Injection Vectors
The headline cluster here is the trio of tarfile fixes. The tarfile module has been a path traversal minefield for years, and this release slams shut three more bypasses of the data filter protections introduced in CVE-2026-3644, which itself patched CVE-2025-4330.
The fixes (gh-149486, gh-151558, gh-151987) address crafted archives that could create symlinks pointing outside the destination directory. One patch ensures tarfile.TarFile.extract() applies the filter as a fallback when extracting link targets. Another strips trailing separators when resolving symlink directories. If your application untars user-uploaded archives, these are the patches you need to prioritize.
Not cheap in terms of risk reduction for services processing untrusted tarballs.
Web browsers and cookies also got hardening. webbrowser.open() now rejects URLs with leading dashes, closing a vector where system command-line tools could misinterpret a URL as an option flag. macOS users can breathe a sigh of relief that osascript invocations in webbrowser and turtledemo now use absolute paths, killing a PATH manipulation risk.
Cookie injection is also blocked. Control characters are now rejected in http.cookies.Morsel.update() and BaseCookie.js_output(). If your web apps generate cookies from user-controlled data, this stops HTTP response splitting via cookie values.
Wsgi developers shouldn't ignore the fix to wsgiref.handlers, which disallows control characters in the status field to prevent header injection.
shutil.unpack_archive() for ZIP files on Windows gets its own path traversal fix. Archives with Windows drive prefixes in their paths could previously write outside the destination tree. Such invalid paths are now skipped.
DoS and Memory Safety
The denial-of-service surface has shrunk significantly. The team tackled quadratic and exponential complexity issues across csv, html.parser, configparser, xml.etree.ElementTree, and unicodedata.
csv.Sniffer.sniff() previously exploded on samples with many quote characters. That exponential and quadratic backtracking is gone. HTML parsing for long unterminated constructs, config parser whitespace handling, and XPath index predicates with many siblings all now cap their complexity. tomllib limits excessive parts in TOML keys. http.client caps unbounded trailer lines and interim 1xx responses at 100 each, protecting clients from malicious or broken servers.
XML parsing gets the full treatment. xml.parsers.expat had unbounded C recursion in ElementDeclHandler() that could crash via crafted XML. That's fixed. The "billion laughs" defense now exposes tuning methods for activation thresholds and maximum amplification. Hash flooding protections improved for ElementTree and expat, provided you're running libexpat 2.8.0 or later. You will be, since all three releases bundle libexpat 2.8.3.
Memory safety fixes round out the list. bz2, lzma, and internal zlib decompressors had dangling pointer bugs triggered when MemoryError interrupted a decompression call. A subsequent decompress() could read through a stale pointer. Additionally, bz2.BZ2Decompressor could overflow the stack if reused after an error, and the module now becomes unusable after a libbz2 failure to prevent that pattern.
For AArch64 users on modern ARM silicon with pointer authentication, Python 3.12.14 and 3.11.16 add branch protection instructions for the -X perf_jit profiler code. The fix is also backported to 3.10.21 where relevant.
Finally, ftplib completes the fix for CVE-2021-4189. The undocumented ftpcp function no longer trusts the IPv4 address in a PASV response by default. The old behavior remains opt-in via trust_server_pasv_ipv4_address = True.
It's a dense batch. The tarfile bypasses are the most urgent for anyone processing user archives, but the CSV and XML DoS fixes matter just as much for operational stability. Head here to get the downloads: Python 3.12.14, Python 3.11.16, and Python 3.10.21.
