Python Ships Emergency Updates After eMudhra Keys Enable Any-Domain Certificates
The Python team released accelerated security updates on Sunday for five supported branches after compromised eMudhra intermediate-certificate keys made it possible to issue valid certificates for arbitrary domains. Administrators running the affected Python versions should update promptly, with the release also addressing separate flaws in archive extraction, cookie handling and XML parsing.
The certificate problem is tracked as CVE-2026-115557 and carries a CVSS score of 9.4. The affected private keys were weak enough to guess, and Python's ssl module now rejects certificate chains that use the eight affected CA certificates. That is a defensive check inside Python's TLS handling, rather than a claim that every system using an affected certificate has been compromised.
The update protects pip from attacks using the affected keys even when pip itself has not yet been upgraded, including the process of updating pip. Python's release guidance nevertheless recommends pip 26.2.2, certifi 2026.10.19 and uv 0.13.4 or newer. Those package versions should be checked separately in environments that use them; the supplied advisory does not provide a broader inventory of affected applications.
The available release choices depend on the branch in use. Binary installers are provided for Python 3.15.2 and 3.14.10, while Python 3.13.18, 3.12.16 and 3.11.18 are supplied only as source code in this release. Teams should therefore match the update to their deployed branch and installation method rather than assuming that one installer covers every supported version.
The same releases fix CVE-2026-114583 in tarfile, rated CVSS 6.9. A crafted link entry could bypass tar_filter during extraction and place files outside the intended destination; the patched behavior rejects link entries that replace the destination directory itself. Archive-processing services should treat this as a separate risk from the TLS issue.
Python also changed http.cookiejar.DefaultCookiePolicy so cookies with negative version numbers are treated as invalid and ignored. Before the fix, a server could use such cookies to set or overwrite cookies for another domain, although the supplied report says the flaw did not let a server read foreign cookies. Older branches additionally receive fixes for Expat XML-parser vulnerabilities, Windows MIME-type handling and temporary-directory cleanup.