Python Updates Block Compromised eMudhra Certificate Keys in Critical TLS Fix

Python released expedited security updates to address CVE-2026-115557, a critical certificate-revocation checking flaw in CPython’s ssl module rated CVSS 9.4. The updates add a denylist for known compromised certificates, including affected eMudhra intermediate certificate keys, and reject certificate chains using those keys regardless of SSLContext policy or whether revocation checking is configured. The protection also covers pip operations without requiring pip itself to be updated first. The CVE record does not report active exploitation.

Administrators should upgrade to Python 3.15.2, 3.14.10, 3.13.18, 3.12.16, or 3.11.18, as appropriate for their branch. The release team also recommends pip 26.2.2, certifi 2026.10.19, and uv 0.13.4 or newer. All five Python releases additionally fix a tarfile extraction-filter bypass and an http.cookiejar cookie-domain validation flaw. Older branches receive further fixes involving Expat, Windows MIME-type configuration, and email-header quoting, with selected versions also addressing unsafe temporary-directory cleanup.