Python-3.15.2 (Python CVE-2026-114583)

[Joe Locash]

New vulnerability. This is not fixed in the latest Python releases:

Subject: [Security-announce][CVE-2026-114583] tarfile.tar_filter path traversal bypass
 allows writing outside the extraction directory
Date: Thu, 22 Oct 2026 21:35:28 +0100
From: Stan Ulbrych via Security-announce <security-announce@python.org>
Reply-To: security-sig@python.org
To: security-announce@python.org
Cc: Stan Ulbrych <stanulbrych@gmail.com>

There is a MEDIUM severity vulnerability affecting CPython.

tarfile.tar_filter could be bypassed using crafted link entries, including
symlinks with empty or directory-like names, to redirect later archive
members outside the intended extraction directory. This allowed a malicious
tar archive to cause tarfile.extractall() with filter="tar" to write files
outside the destination directory, subject to the permissions of the
extracting process.

This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered
tarfile.data_filter.

Please see the linked CVE ID for the latest information on affected
versions:

* https://www.cve.org/CVERecord?id=CVE-2026-114583
* https://github.com/python/cpython/pull/160098

3.15 backport: ​https://github.com/python/cpython/pull/160339

3.14 backport: ​https://github.com/python/cpython/pull/160340

[Joe Locash]

The fun continues...

Subject: [Security-announce][CVE-2026-115557] Distrust compromised intermediate
 certificates in ssl module
Date: Sat, 24 Oct 2026 14:20:01 +0000
From: Seth Larson <seth@python.org>
Reply-To: security-sig@python.org
To: security-announce@python.org

Python has added a denylist for known compromised certificates to the "ssl"
module to ensure user safety even without certificate revocation
configured. Known compromised certificates on this denylist will
automatically be rejected regardless of the SSLContext policy configuration.

Please see the linked CVE ID for more information:

* https://www.cve.org/CVERecord?id=CVE-2026-115557
* https://github.com/python/cpython/pull/160042

The CVE is rated critical.

3.15 backport: ​https://github.com/python/cpython/pull/160568

3.14 backport: ​https://github.com/python/cpython/pull/160569

[Bruce Dubbs]

I asked Claude: Are CVE-2026-114583 and CVE-2026-115557 covered in Python-3.15.1?

Answer:

No, Python 3.15.1 fixes neither CVE. 3.15.1 was tagged on October 21, and I searched its source for both CVE numbers and found no mention.

CVE-2026-114583 (CVSS 4.0: 6.9, Medium)

A crafted tar file can get past tarfile’s filter="tar" protection and write files outside the extraction directory. The fix was merged on October 22, the day after 3.15.1 was tagged. It’s in the 3.15 and 3.14 branches but not yet in any release. It should be in 3.15.2.

CVE-2026-115557 (CVSS 4.0: 9.4, Critical)

This is the eMudhra key compromise again, the same issue behind the certifi and NSS updates. The fix adds a built-in denylist to the ssl module, so the compromised intermediate certificates are rejected even if the system CA store still trusts them. The pull request (#160042) was still open and unmerged as of October 23. On a BLFS system Python’s ssl uses the system certificate store by default, so updating NSS and running make-ca -g covers most of the exposure until Python ships the fix.

To cover both CVEs you’ll need to wait for 3.15.2.

[Joe Locash]

Replying to Bruce Dubbs:

I asked Claude: Are CVE-2026-114583 and CVE-2026-115557 covered in Python-3.15.1?

Answer:

No, Python 3.15.1 fixes neither CVE. 3.15.1 was tagged on October 21, and I searched its source for both CVE numbers and found no mention.

CVE-2026-114583 (CVSS 4.0: 6.9, Medium)

A crafted tar file can get past tarfile’s filter="tar" protection and write files outside the extraction directory. The fix was merged on October 22, the day after 3.15.1 was tagged. It’s in the 3.15 and 3.14 branches but not yet in any release. It should be in 3.15.2.

CVE-2026-115557 (CVSS 4.0: 9.4, Critical)

This is the eMudhra key compromise again, the same issue behind the certifi and NSS updates. The fix adds a built-in denylist to the ssl module, so the compromised intermediate certificates are rejected even if the system CA store still trusts them. The pull request (#160042) was still open and unmerged as of October 23. On a BLFS system Python’s ssl uses the system certificate store by default, so updating NSS and running make-ca -g covers most of the exposure until Python ships the fix.

To cover both CVEs you’ll need to wait for 3.15.2.

So we follow the advice of AI now?

[Bruce Dubbs]

Replying to Joe Locash:

So we follow the advice of AI now?

Maybe. But only if it makes sense.

[Bruce Dubbs]

What's New in Python 3.15.2 final?

*Release date: 2026-10-25*

Security

• gh-160300: Fix :class:http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.

• gh-160097: :func:tarfile.tar_filter now rejects link members whose path resolves to the destination directory itself, as :func:tarfile.data_filter already did.

• gh-160040: :mod:ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the :rfc:5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.

Core and Builtins

• gh-160491: Fix the location reported for invalid escape sequences in f-strings and t-strings. The :exc:SyntaxError now points at the literal part that contains the escape, instead of at the closing quote.

• gh-160268: Fix a crash in :mod:tokenize when a mismatched closing bracket follows the opening brace of an f-string or t-string replacement field, as in f'{]a'. It now raises the same "unmatched" error as the parser.

• gh-106045: Fix :mod:venv path discovery when the base executable resolves to a location outside the installation pointed to by the home key in pyvenv.cfg. The standard library is now found from home, and extension modules from the resolved executable's installation, instead of falling back to the compiled-in prefix.

• gh-160162: Fix a crash on 32-bit platforms when left shifting an :class:int by a count close to sys.maxsize * sys.int_info.bits_per_digit. :exc:OverflowError is now raised, as for other too large counts.

• gh-160179: Fix :meth:!bytearray.__init__ leaving uninitialized memory in the object when it fails on a :class:list or :class:tuple containing an integer not in range(256). The object is now empty after the failed call.

• gh-159739: Fix a possible crash when assigning metadata to :class:classmethod or :class:staticmethod objects.

• gh-159739: Fix a race in list.sizeof() when a list is concurrently resized on a free-threaded build.

• gh-159739: Fix a reference leak when the value of a type alias is evaluated recursively or concurrently.

• gh-159739: Fix a crash in free-threaded builds when :func:codecs.unregister is called concurrently.

• gh-159963: Fix a regression in Python 3.15.0 where threads importing submodules of packages for the first time could raise _DeadlockError or a spurious "partially initialized module" :exc:ImportError, or block one another, with no circular import involved. :func:importlib.import_module now returns the partially initialized module in a cross-thread circular import, as the :keyword:import statement does, instead of raising _DeadlockError.

• gh-159739: Fix reference leaks when free-threaded garbage collection aborts early because of an allocation error.

• gh-159739: Prevent free-threaded builds from interning and immortalizing complex subclasses in code object constants.

• gh-159739: Fix a reference leak in binary, ternary, and comparison operations on weak reference proxies when another operand is a dead proxy.

• gh-159739: Fix a crash when constructing an error for invalid generic alias arguments.

• gh-159739: Allow the garbage collector to break reference cycles involving property accessors or names.

• gh-159739: Fix a crash in :func:warnings.warn when skip_file_prefixes is an empty tuple subclass. Propagate allocation errors when creating the fallback filename.

• gh-159431: Fix an assertion failure, or an immortal object becoming mortal, on the :term:free threaded <free threading> build when an object passed to the internal delayed decref mechanism is immortal or becomes immortal before the delayed decref is processed by the garbage collector.

• gh-159294: Fix a crash in a debug build when creating an :exc:ExceptionGroup or :exc:BaseExceptionGroup fails with :exc:MemoryError.

• gh-159244: Fix a crash in :class:dict and :meth:dict.update in the :term:free-threaded build when another thread concurrently mutates a list used as a key/value pair.

• gh-159111: Update mimalloc version from 2.1.2 to 2.5.2.

• gh-154318: Fix a crash when hashing a deeply nested :class:tuple or :class:frozendict. A :exc:RecursionError is now raised instead of overflowing the C stack.

• gh-151818: Fix a double-free crash in list.append() (the specialized CALL_LIST_APPEND instruction) when growing the list fails with :exc:MemoryError.

Library

• gh-160549: Fix a crash when a :class:compression.zstd.ZstdCompressor that uses worker threads and a :class:~compression.zstd.ZstdDict is deallocated, or the interpreter exits, while data passed to :meth:~compression.zstd.ZstdCompressor.compress is still being compressed.

• gh-160535: Fix a crash in :mod:compression.zstd when the garbage collector frees a :class:~compression.zstd.ZstdCompressor that uses worker threads together with its :class:~compression.zstd.ZstdDict before the compression of already submitted data has finished.

• gh-160520: Fix :mod:asyncio SSL transports not applying *ssl_shutdown_timeout* when the peer has sent EOF but does not read the data still queued for it. Closing such a connection could wait indefinitely; it is now aborted with :exc:TimeoutError once the timeout expires.

• gh-160326: Raise :exc:ValueError for a NaN *timeout* in :meth:threading.Condition.wait and the blocking calls built on it, such as :meth:threading.Event.wait, :meth:threading.Semaphore.acquire and :meth:queue.Queue.get, instead of returning at once or looping without ever timing out.

• gh-159739: Fix crashes in :mod:profiling.tracing when a custom timer reinitializes the profiler or its result clears or disables the profiler during conversion or cleanup.

• gh-159739: Fix crashes in :mod:xml.parsers.expat when a character data callback disables buffering or clears another handler during a flush, or when interning an attribute name changes :attr:~xml.parsers.expat.xmlparser.ordered_attributes.

• gh-160299: Fix :meth:symtable.Symbol.is_referenced for local and nonlocal symbols in function scopes when their only uses are in inlined comprehensions.

• gh-159739: Fix a crash when a :mod:ctypes structure subclass cannot be created due to an allocation failure.

• gh-159739: Fix clearing a :class:pickle.Unpickler memo so that the unpickler can be reused for independent records.

• gh-160171: On the server side, :meth:ssl.SSLSocket.get_unverified_chain now returns the client's certificate when the session was resumed from a session ticket, instead of an empty list, and returns an empty list instead of raising :exc:AttributeError when the client sent no certificate.

• gh-159739: Fix a possible crash in :class:abc.ABCMeta instance checks when a subclass-checking callback changes the instance’s class.

• gh-159739: Fix the truncate method on :class:io.BytesIO when converting its size argument closes the stream or exports its buffer.

• gh-159739: Fix :class:contextvars.ContextVar returning a stale value after a reentrant finalizer changes it during :meth:~contextvars.ContextVar.reset.

• gh-159739: Detect recursive _as_parameter_ chains for :mod:ctypes calls without argument types.

• gh-159739: Fix a possible crash when a list of :mod:sqlite3 parameters is modified concurrently on a free-threaded build.

• gh-159739: Avoid a crash when a :class:threading.local subclass finalizer accesses attributes after construction fails.

• gh-159739: Avoid a crash when a :class:queue.SimpleQueue subclass finalizer adds an item after construction fails.

• gh-100609: str() of a :class:zipfile.Path whose underlying zipfile has no filename, such as one constructed from an :class:io.BytesIO, now renders that filename as :zipfile: instead of raising :exc:TypeError. The root of a zipfile is also no longer rendered with a trailing slash. Synchronized with :pypi:zipp 3.23.1.

• gh-159690: Fix :class:logging.handlers.TimedRotatingFileHandler permanently stopping rollover after a rollover failed or its backup file already existed, for example at a DST change.

• gh-159739: Avoid undefined behavior when :func:struct.pack_into copies a bytearray into overlapping output.

• gh-159739: Fix allocation error handling in the fallback implementation of getaddrinfo().

• gh-159739: Fix a double free if remote unwinder initialization runs out of memory.

• gh-159739: Fix :meth:io.IOBase.readline returning more bytes than requested when a stream supports :meth:!peek and returns short reads.

• gh-159739: Fix multibyte encoders silently consuming a non-BMP character when looking up a two-character mapping.

• gh-159739: Fix off-by-one output buffer checks in the fallback implementation of getnameinfo().

• gh-159739: Fix reference cycles involving the types of grapheme iterators and segments created by :func:unicodedata.iter_graphemes.

• gh-159706: Fix the pure-Python :class:zoneinfo.ZoneInfo setting fold=0 in :meth:~datetime.tzinfo.fromutc for times in the fold created by the only transition of a zone with a single transition.

• gh-159714: Fix :class:zoneinfo.ZoneInfo interpreting the Julian day rule J59 as February 29 in leap years instead of February 28.

• gh-159304: Fix :exc:AttributeError in :meth:email.message.EmailMessage.get_body when a nested multipart part is malformed and its payload is a string.

• gh-158287: Fix a bug in :mod:asyncio where stopping a child process (such as with SIGSTOP) on macOS caused the event loop to block indefinitely.

• gh-130698: Fix PyREPL to convert :data:sys.ps1 and :data:sys.ps2 to strings before use, and fall back to the default prompts if the conversion raises.

• gh-158126: Speed up :func:pickle.dumps and creating a :class:pickle.Pickler by avoiding the creation of an :exc:AttributeError when looking up the optional reducer_override and dispatch_table attributes.

• gh-157880: Fix :class:mailbox.Babyl to write the visible headers of a :class:mailbox.BabylMessage to the mailbox file.

• gh-156784: :class:asyncio.ProactorEventLoop no longer silently ignores :exc:ConnectionResetError on UDP sockets, matching :class:asyncio.SelectorEventLoop.

• gh-156078: :meth:zipfile.ZipFile.mkdir now raises :exc:ValueError when the archive is closed or when a writable member handle is open.

• gh-155833: Ensure that MD5 and SHA* objects are properly GC-untracked before freeing their internal HACL* state.

• gh-155428: Ensure that :func:hmac.digest and :meth:hmac.HMAC.digest output identical values when using a digest's block size smaller than 16.

• gh-155152: Improve performance of some :mod:zipimport archives that use Zstandard compression.

• gh-153679: :class:zipimport.zipimporter now raises :exc:zipimport.ZipImportError instead of :exc:UnicodeDecodeError for a UTF-8-flagged file name that is not valid UTF-8.

• gh-153319: The :mod:turtledemo viewer now reads each demo script as UTF-8 instead of the locale encoding.

• gh-127636: Fix :meth:tarfile.TarFile.extract to accept archive member names with a trailing forward slash, including those returned by :meth:tarfile.TarFile.getnames. Contributed by Xiao Yuan.

• gh-149527: :mod:multiprocessing: fix creation of temporary socket files following :gh:137335 (`PR#148578 <​https://github.com/python/cpython/pull/148578>` and corresponding backports).

• gh-146169: :mod:xml.parsers.expat: raise :exc:RuntimeError when an Expat handler calls :meth:`parser.Parse <xml.parsers.expat.xmlparser.Parse> or :meth:parser.ParseFile <xml.parsers.expat.xmlparser.ParseFile>` on the parser that called the handler.

• gh-140036: Avoid hanging in floor division of pure Python :class:decimal.Decimal instances when the context precision is very large.

Build

• gh-128883: Fix crashes with -X perf and -X perf_jit in BOLT builds. The ELF perf trampoline templates now use read-only data sections.

• gh-160004: Fix the paths in the :pep:739 build-details.json file generated by :file:Tools/build/generate-build-details.py with both --relative-paths and --config-file-path. Previously, every path except base_prefix was wrong and depended on the directory the script was run from.

• gh-159998: Fix libpython.dynamic in the :pep:739 build-details.json file for macOS and iOS framework builds. It now points at the framework's library instead of a nonexistent path under :file:lib/.

• gh-144942: Fix the macOS shared library and framework builds not linking the libraries required by built-in modules, such as the HACL* objects needed by _blake2 when it is built in via :file:Modules/Setup.local.

• gh-159819: Fix the shell version of :program:python3-config (used on all POSIX platforms except macOS) when the installation prefix contains spaces or other characters special to the shell or :program:sed: it printed an empty --prefix and wrong --includes/--ldflags paths while exiting successfully. The script now also exits with status 1 if it cannot determine its installation prefix.

• gh-157354: Fix the :samp:--with-{name}-sanitizer=no and :samp:--without-{name}-sanitizer :program:configure options enabling the sanitizer instead of disabling it.

• gh-155813: On macOS, :option:LIBFFI_CFLAGS and :option:LIBFFI_LIBS are no longer ignored when the SDK provides libffi, so :mod:ctypes can again be built against a different libffi.

C API

• gh-159739: Avoid a crash if a context watcher is cleared while other context watchers are being notified.

[Bruce Dubbs]

Updated at commit 7b2e4cbc0, Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.1-089 has been issued.