Image: Python logo via Wikimedia Commons / www.python.org (official Python logo; software has no product photo, so the logo is the featured visual).
ssl module, so even tools that never got the earlier pip update can no longer be tricked by those keys. If you run Python, upgrade to your series' new version.📌 KEY HIGHLIGHTS
- The news: Five Python versions patched in one day — 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 — in what the release team calls "expedited security releases".
- The headline fix: The compromised eMudhra intermediate CA keys are now blocked by Python's
sslmodule, described as a last-resort defence against their use. - Why it matters for pip users: Normal pip use — including upgrading pip itself — is now safe from attacks based on those keys, even if pip hasn't been updated yet.
- Installers: 3.15.2 and 3.14.10 ship binary installers; 3.13.18, 3.12.16 and 3.11.18 are source-only security releases.
- Also fixed in all five: a tarfile filter bypass (CVE-2026-114583) and a cookie-parsing flaw in
http.cookiejar. - Not a new attack: No misissued certificates or attacks using these keys have been reported — this is a hardening patch, not an emergency response to an active exploit.
What happened?
Python's release team — Hugo van Kemenade, Thomas Wouters, Pablo Galindo Salgado, Ned Deily and Steve Dower — published the five releases on 26 October 2026, five days after the previous round of eMudhra-related patches. If you followed that earlier round, this one may look familiar, and that is the point: it completes the job. Our earlier coverage of Python 3.15.1's security update explained how the 21 October releases shipped new pip and certificate bundles; this release adds a deeper layer of protection underneath them.
The background, briefly: eMudhra is an Indian certificate authority that sells certificates under the emSign brand. In October, researchers found that eight of its intermediate CA private keys were shockingly weak — elliptic-curve keys whose secret value was a tiny number (one of them was literally 4), recoverable by trying a few hundred guesses instead of the astronomical search a proper 384-bit key requires. Anyone holding one of those keys could forge a certificate for any website. Browsers and operating systems blocked the keys within days, and eMudhra revoked all eight on 19 October. The full advisory story is in our CERT-In eMudhra advisory post.
Python 3.15.2 security release explained: what each version gets
Every one of the five releases carries the same three core security fixes. The older three series pick up a few extra fixes that the newer series already had. Here is the full picture:
| Release | Type | What it fixes |
|---|---|---|
| Python 3.15.2 | Binary installer | eMudhra key block (CVE-2026-115557), tarfile fix (CVE-2026-114583), cookiejar fix |
| Python 3.14.10 | Binary installer | Same three core fixes |
| Python 3.13.18 | Source-only | Core fixes + Expat 2.9.0, Windows mimetypes fix, header-quoting fix, tempfile race fix |
| Python 3.12.16 | Source-only | Core fixes + Expat 2.9.0, Windows mimetypes fix, header-quoting fix, tempfile race fix |
| Python 3.11.18 | Source-only | Core fixes + Expat 2.9.0, Windows mimetypes fix, header-quoting fix |
Illustrative image: servers in a data centre (Wikimedia Commons / BalticServers). Python runs behind a huge share of the web's servers and data pipelines — which is why an interpreter-level certificate fix matters.
Why the ssl-module block is the important part
The 21 October round fixed the problem at the tooling layer: pip 26.2.2 and certifi 2026.10.19 stopped trusting the compromised certificates for package downloads. But pip is not the only thing in a Python installation that checks certificates — and not every Python on a machine is a freshly updated one. Embedded runtimes, system Pythons, containers built months ago and CI images can all carry old bundles, and updating the operating system does not fix a Python that ships its own certificate list.
The 26 October releases fix it one layer deeper. By blocking the compromised keys inside the ssl module itself, Python now refuses those keys no matter which certificate bundle a program happens to load — the release team calls it "a last resort against their use". In practice: a script that opens an HTTPS connection, a service that fetches a webhook, or a pip run on an older pip version all get the same protection from the interpreter itself. That is also why the release note stresses that normal pip use is safe "even if pip hasn't been updated yet" — the interpreter now covers for the tool.
The other two core fixes are smaller but worth knowing. The tarfile fix (CVE-2026-114583) stops a crafted archive member from replacing the destination path used by tarfile.tar_filter — a path-manipulation flaw in archive extraction. The cookiejar fix rejects cookies carrying a negative version number, closing a parsing edge case in http.cookiejar. Neither has reported real-world exploitation; both are the kind of quiet hardening that ships in security rounds like this.
What should you update?
The release team's advice is blunt: "upgrading is highly recommended to all users of affected versions." In practice, that means:
- Your own machine: move to the new patch release of whichever series you run — 3.15.2, 3.14.10, 3.13.18, 3.12.16 or 3.11.18. The 3.15 and 3.14 installers are one-click downloads; the older three are source-only, so most users will pick them up through their OS package manager, pyenv or Docker image rebuilds.
- Virtual environments and containers: rebuild images and recreate virtualenvs on the new base — an old image still carries the old interpreter even after you update your laptop.
- If you are still on Python 3.10: there is no patch for you. As our Python 3.10 end-of-life post explained, 3.10 receives no further security updates at all — the fix is a planned upgrade to a supported series, not another patch.
- Check pip and certifi too: pip 26.2.2+ and certifi 2026.10.19+ remain the recommended tooling versions from the 21 October round; the interpreter patch complements them, it does not replace keeping tools current.
Should you care?
FAQs
What is Python 3.15.2?
An expedited security release of Python 3.15, published 26 October 2026 alongside 3.14.10, 3.13.18, 3.12.16 and 3.11.18. It contains no new features — only security fixes, led by the block on compromised eMudhra certificate keys.
What is the eMudhra certificate problem?
Eight intermediate CA keys belonging to Indian certificate authority eMudhra turned out to be guessable — one private key was the number 4. Anyone with a key could forge certificates for any website. Browsers, operating systems and now Python itself have all blocked them; no attacks using them have been reported.
Do I need to update if I already updated pip?
Yes — ideally both. The pip/certifi update from 21 October protects package downloads; the 26 October interpreter update protects every HTTPS connection your Python programs make, including tools that never got the pip update. They are complementary layers.
Why are 3.13.18, 3.12.16 and 3.11.18 source-only?
The release team ships binary installers only for the two newest series (3.15 and 3.14). Older supported series get source releases, and users pick them up through OS packages, version managers like pyenv, or rebuilt container images.
Is Python 3.10 patched by this release?
No. Python 3.10 reached end of life and receives no security updates. Anyone still on 3.10 should plan an upgrade to a supported series — 3.12 or newer is the sensible floor.
Takeaway: Python just put a lock on the door behind the lock — the interpreter itself now refuses the compromised eMudhra keys, so even an unpatched pip can't be fooled by them. Update to your series' new patch release and move on.
Follow World Tech on TechByCountry for tomorrow's 6 PM update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
Python official blog — Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out (26 October 2026)
Python Discuss — announcement mirror with release details
OMSF — Security Advisory: Python Certificate Authority Vulnerability (23 October 2026)
Cybernews — eMudhra certificates lose trust after key blunder
Comments
Post a Comment