--- title: Python 3.12.14, 3.11.16 and 3.10.21 are now available! description: Python 3.12.14, 3.11.16, and 3.10.21 are security-only releases patching numerous vulnerabilities across the standard library. Fixes address multiple CVEs... canonical: https://daily.dev/posts/python-3-12-14-3-11-16-and-3-10-21-are-now-available--8j1vyqar6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Python 3.12.14, 3.11.16 and 3.10.21 are now available! | daily.dev og:description: Python 3.12.14, 3.11.16, and 3.10.21 are security-only releases patching numerous vulnerabilities across the standard library. Fixes address multiple CVEs... og:url: https://daily.dev/posts/python-3-12-14-3-11-16-and-3-10-21-are-now-available--8j1vyqar6 og:image: https://api.daily.dev/og/posts/8J1VYQAR6.png og:image:alt: Python 3.12.14, 3.11.16 and 3.10.21 are now available! og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Python 3.12.14, 3.11.16 and 3.10.21 are now available! **[Python Insider](https://daily.dev/sources/python)** · 6 min read · 1 upvotes · 0 comments ## Summary Python 3.12.14, 3.11.16, and 3.10.21 are security-only releases patching numerous vulnerabilities across the standard library. Fixes address multiple CVEs including CVE-2026-2297 (SourcelessFileLoader using io.open_code for .pyc files), CVE-2026-4224 (pyexpat crash from deep XML recursion), CVE-2026-3644 (control character injection in http.cookies), and a bypass of CVE-2025-4330 (tarfile symlink path traversal). Other fixes cover denial-of-service issues in unicodedata.normalize, html.parser, configparser, csv.Sniffer, and ElementTree, plus a Windows shutil.unpack_archive path traversal bug and hardening of http.client against malicious server responses. All users of these Python versions are strongly urged to upgrade. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What security issues does Python 3.12.14 fix? Python 3.12.14 fixes numerous vulnerabilities, including CVE-2026-2297 (SourcelessFileLoader not using io.open_code for .pyc files), CVE-2026-4224 (crash from unbounded recursion in pyexpat's ElementDeclHandler), CVE-2026-3644 (missing control-character rejection in http.cookies), and a bypass of CVE-2025-4330 involving symlinks escaping the destination directory during tarfile extraction. Several quadratic-time and DoS bugs in csv, configparser, and html.parser are also patched. _Track new CVEs and breaking security patches across your Python stack with daily.dev._ ### Why does Python's tarfile extraction filter still have path-traversal issues after CVE-2025-4330 was fixed? A remaining bypass let crafted archives create a symlink pointing outside the destination directory even after the original CVE-2025-4330 fix. Python 3.12.14 closes this by validating link targets against the same normalized path written to disk, stripping trailing separators from member names when resolving a symlink's directory, and rejecting link members that would replace the destination directory itself. _Developers hardening archive extraction code can follow tarfile security fixes on daily.dev._ ### Do I need to upgrade if I'm running Python 3.10 or 3.11 instead of 3.12? Yes, matching security releases 3.11.16 and 3.10.21 are also available and are strongly recommended for anyone on those branches, alongside a DER-parsing fix in ssl.SSLContext.load_verify_locations that rejects trailing data it previously accepted incorrectly. Both older branches receive source-only releases since they are in security-fix-only mode with no fixed cadence. _Keep multiple Python version upgrades on your radar by following release notes on daily.dev._ ## Similar posts on daily.dev - [Python 3.15.0a8, 3.14.4 and 3.13.13 are out\!](https://daily.dev/posts/python-3-15-0a8-3-14-4-and-3-13-13-are-out--fpknzjqcr) · Python Insider · 29 upvotes · 1 comments - [Django Security Fixes, Python Releases, and New Tools](https://daily.dev/posts/django-security-fixes-python-releases-and-new-tools-xiycsmntw) · Django News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python) [View this post on daily.dev](https://daily.dev/posts/python-3-12-14-3-11-16-and-3-10-21-are-now-available--8j1vyqar6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Python 3.12.14, 3.11.16 and 3.10.21 are now available!","url":"https://daily.dev/posts/python-3-12-14-3-11-16-and-3-10-21-are-now-available--8j1vyqar6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/python-3-12-14-3-11-16-and-3-10-21-are-now-available--8j1vyqar6"},"datePublished":"2026-08-13T00:19:37.815Z","dateModified":"2026-09-14T08:44:53.442Z","description":"Python 3.12.14, 3.11.16, and 3.10.21 are security-only releases patching numerous vulnerabilities across the standard library. Fixes address multiple CVEs...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bb5f51b2ab5abe72545316100580cc3f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bb5f51b2ab5abe72545316100580cc3f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Python Insider","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Python Insider","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/124b62e20f2f41c49bc701276f871a11","url":"https://daily.dev/sources/python"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/python-3-12-14-3-11-16-and-3-10-21-are-now-available--8j1vyqar6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,python","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Python Insider","item":"https://daily.dev/sources/python"},{"@type":"ListItem","position":3,"name":"Python 3.12.14, 3.11.16 and 3.10.21 are now available!"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/python-3-12-14-3-11-16-and-3-10-21-are-now-available--8j1vyqar6#faq","mainEntity":[{"@type":"Question","name":"What security issues does Python 3.12.14 fix?","acceptedAnswer":{"@type":"Answer","text":"Python 3.12.14 fixes numerous vulnerabilities, including CVE-2026-2297 (SourcelessFileLoader not using io.open_code for .pyc files), CVE-2026-4224 (crash from unbounded recursion in pyexpat's ElementDeclHandler), CVE-2026-3644 (missing control-character rejection in http.cookies), and a bypass of CVE-2025-4330 involving symlinks escaping the destination directory during tarfile extraction. Several quadratic-time and DoS bugs in csv, configparser, and html.parser are also patched. Track new CVEs and breaking security patches across your Python stack with daily.dev."}},{"@type":"Question","name":"Why does Python's tarfile extraction filter still have path-traversal issues after CVE-2025-4330 was fixed?","acceptedAnswer":{"@type":"Answer","text":"A remaining bypass let crafted archives create a symlink pointing outside the destination directory even after the original CVE-2025-4330 fix. Python 3.12.14 closes this by validating link targets against the same normalized path written to disk, stripping trailing separators from member names when resolving a symlink's directory, and rejecting link members that would replace the destination directory itself. Developers hardening archive extraction code can follow tarfile security fixes on daily.dev."}},{"@type":"Question","name":"Do I need to upgrade if I'm running Python 3.10 or 3.11 instead of 3.12?","acceptedAnswer":{"@type":"Answer","text":"Yes, matching security releases 3.11.16 and 3.10.21 are also available and are strongly recommended for anyone on those branches, alongside a DER-parsing fix in ssl.SSLContext.load_verify_locations that rejects trailing data it previously accepted incorrectly. Both older branches receive source-only releases since they are in security-fix-only mode with no fixed cadence. Keep multiple Python version upgrades on your radar by following release notes on daily.dev."}}]} ```