Python has released updates across five supported runtime branches: Python 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8. The releases address multiple security issues affecting areas such as TLS validation, archive extraction, compressed data handling, Unicode processing, and bundled libraries.
The release set also marks an important lifecycle change. Python 3.10.22 is the final release for the Python 3.10 branch, while Python 3.11.17 and 3.12.15 are source-only security releases. Python 3.13.16 and 3.14.8 continue to provide documented macOS and Windows installers, along with source artifacts and verification metadata.
What changed in the Python releases
The Python project announcement lists all five releases as available on October 1, 2026. The individual release pages give more detail, with the pages for Python 3.12.15, 3.13.16, and 3.14.8 listing September 30, 2026 as their release date. Python 3.11.17 is listed as an October 1 release. This is a difference between the announcement date and the dates shown on individual release pages, not a conflict over availability.
Across the branches, the documented changes include:
- TLS validation and SSL callback handling updates.
- Archive-extraction filter changes involving
tarfile. - Protection against memory exhaustion related to
zipfiledecompression. - Changes affecting URL credential scoping in
urllib.request. - Updates to stringprep and IDNA processing.
- Updates to bundled Expat and, in Python 3.14.8, bundled OpenSSL components.
- Additional fixes, including float-formatting changes and HTTPPasswordMgr credential handling in some branches.
The exact change lists vary by branch. Developers should consult the relevant Python 3.11.17, Python 3.12.15, Python 3.13.16, or Python 3.14.8 release page before applying a branch-specific update.
Python 3.10 reaches end of life
Python 3.10.22 is the final release for Python 3.10, which has reached end of life. Organizations still running that branch should treat the update as the last available release in the series and plan a migration to a newer Python version.
The supplied release information does not establish application-specific compatibility for a migration. Teams should therefore test their applications, dependencies, deployment images, and operational tooling as part of their own upgrade process rather than assuming that moving to a newer branch will be transparent.
Python 3.11 and 3.12 are now source-only
Python 3.11.17 and Python 3.12.15 are security bugfix releases, but neither includes binary installers. Python 3.11.9 was the last Python 3.11 release with binary installers, while Python 3.12.10 was the last Python 3.12 release with them.
This matters for organizations that depend on upstream installers rather than building or distributing their own runtimes. The official release pages provide source archives, checksums, and Sigstore metadata, but the supplied documentation does not define complete operating-system, compiler, build-tool, or dependency requirements for building these releases. It also does not establish whether every package manager provides these exact versions.
Python 3.11 remains in security-fixes-only mode through October 2027, and Python 3.12 remains in that mode through October 2028, according to the official Python download information.
Python 3.13 and 3.14 retain installer availability
Python 3.13.16 is the sixteenth and final full maintenance release for Python 3.13. Future Python 3.13 releases will contain security fixes only. The release provides source archives, checksums, Sigstore metadata, and official macOS and Windows installers. The listed macOS installer supports macOS 10.13 and later; Windows artifacts include 64-bit, 32-bit, ARM64, and embeddable packages.
Python 3.14.8 is an expedited security release and the eighth maintenance release in the Python 3.14 series. It provides source archives, macOS and Windows installers, Android embeddable packages, checksums, and Sigstore metadata. The listed macOS installer supports macOS 10.15 and later, and the Windows downloads include 64-bit, 32-bit, ARM64, and embeddable packages.
These lists describe the artifacts documented on the official release pages. They should not be treated as a complete installer matrix for every operating system or platform.
Details developers should review
Applications using archive extraction deserve particular attention. The releases include changes involving tarfile extraction filters and zipfile decompression. The official information also notes that monkey-patched third-party zipfile decompressors remain vulnerable to the described decompression issue if they do not implement the required needs_input attribute and a two-argument decompress() method.
Teams should review custom or third-party integrations rather than assuming that updating CPython alone resolves an incompatible decompressor implementation.
TLS behavior also requires testing. Python 3.10 through 3.12 emit a DeprecationWarning for missing TLS hostnames when check_hostname is enabled. Python 3.13 and later raise ValueError in that situation. Applications moving to Python 3.13 or newer should check affected TLS code paths and test how the change interacts with their error handling.
The release notes describe these changes as addressing multiple security issues, but the supplied sources do not provide CVSS scores, exploitability assessments, or evidence that the issues have been exploited. Administrators should avoid using the release announcement alone to infer severity or active exploitation.
What you should do
- Inventory deployed Python runtimes. Identify applications using Python 3.10 through 3.14, including runtimes embedded in containers, build systems, scheduled jobs, and internal tools.
- Move off Python 3.10. Because Python 3.10.22 is the final release in the branch, create a migration plan and validate application and dependency compatibility on a newer supported branch.
- Apply the matching branch release. Review the relevant release page and update Python 3.11, 3.12, 3.13, or 3.14 installations where practical.
- Account for source-only distribution. If you use Python 3.11 or 3.12, confirm that your organization can obtain, build, test, and distribute the source-only releases through its existing runtime process. The supplied sources do not prescribe build commands or requirements.
- Test security-sensitive code paths. Exercise tarfile extraction, zipfile decompression, TLS handling, URL credential management, XML parsing, and any SSL callback integrations used by your applications.
- Check custom decompressor implementations. Review monkey-patched zipfile decompressors for the interface requirements documented by the Python project.
- Verify release artifacts. Use the checksums and signature-verification mechanisms documented on the official Python pages before deploying downloaded artifacts.
Lifecycle planning beyond this update
The official download page lists Python 3.13 as a bugfix branch scheduled to end support in October 2029 and Python 3.14 as a bugfix branch scheduled to end support in October 2030. Python 3.13.16 is the last full maintenance release in its series, so teams choosing that branch should expect subsequent releases to contain security fixes only.
For platform teams, the immediate decision is not simply which patch number to install. It is whether each workload should remain on its current branch, move to a newer supported branch, or adopt a source-build process where binary installers are no longer available. The appropriate choice depends on application testing and deployment requirements that are not specified by the Python release pages.
