Python 3.12.14, 3.11.16, and 3.10.21 are security-only releases patching numerous vulnerabilities across the standard library. Fixes address multiple CVEs including CVE-2026-2297 (SourcelessFileLoader using io.open_code for .pyc files), CVE-2026-4224 (pyexpat crash from deep XML recursion), CVE-2026-3644 (control character injection in http.cookies), and a bypass of CVE-2025-4330 (tarfile symlink path traversal). Other fixes cover denial-of-service issues in unicodedata.normalize, html.parser, configparser, csv.Sniffer, and ElementTree, plus a Windows shutil.unpack_archive path traversal bug and hardening of http.client against malicious server responses. All users of these Python versions are strongly urged to upgrade.
Questions this post answers
What security vulnerabilities are fixed in Python 3.12.14?
Python 3.12.14 fixes multiple CVEs including CVE-2026-2297, where SourcelessFileLoader now uses io.open_code when opening .pyc files, CVE-2026-4224, a crash from unbounded C recursion in pyexpat when parsing deeply nested XML content models, and CVE-2026-3644, which rejects control characters in http.cookies.Morsel.update and js_output to prevent header injection. It also closes a bypass of CVE-2025-4330 involving symlinks escaping the destination directory during tarfile extraction. Track CVE fixes and upgrade timing for Python releases as they land on daily.dev.
Why should I upgrade shutil.unpack_archive on Windows in Python 3.12.14?
A vulnerability allowed ZIP archives to write files outside the destination tree on Windows if the archive path contained a Windows drive prefix. Python 3.12.14 now skips such invalid paths, and files containing double dots in the name, like foo..bar, are no longer skipped, closing the extraction path-traversal bypass tracked as gh-146581. Developers hardening archive extraction code follow security patch details on daily.dev.
Does Python 3.11.16 or 3.10.21 fix any new denial-of-service bugs?
No, the additional fixes in 3.11.16 and 3.10.21 only backport a previously released 3.12 fix: ssl.SSLContext.load_verify_locations no longer incorrectly accepts certain cases of trailing data when parsing DER certificates. All newer denial-of-service and quadratic-complexity fixes, such as those in unicodedata.normalize, html.parser, and csv.Sniffer, are included across all three releases as shared security content. Compare fix parity across Python 3.10, 3.11, and 3.12 releases on daily.dev before upgrading.