Python News

This feed includes only recent releases, roughly from the last 12 months, not the full historical archive. That is why a long-established product may have only a few news items.

6 news

Python
python.org release-metadata API auth bypass disclosed and patched

Auth bypass in python.org release management API let a request with admin username + arbitrary API key process as admin, able to alter release/file metadata on python.org/downloads. Existed since 2014; reported 2026-02-23, patched within 48h; PSRT audit found no evidence of exploitation.

Python
Python 3.12.13, 3.11.15, 3.10.20 security release: 4 CVEs fixed

Fixes CVE-2024-6923, CVE-2026-24515, CVE-2026-25210, CVE-2025-59375: email header injection via unsafe folding/delimiters, XML memory-amplification DoS (libexpat bumped to 2.7.4), SSL use-after-free on SSL_new() failure, plus use-after-free/OOB in concurrent list ops (3.11.15/3.10.20).

Discuss Python News

Send via: