# Python 3.14 3.14.4

Python 3.14 3.14.4, released April 7, 2026, fixes 7 CVEs in Python 3.14 (version 3.14.4). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/windows-app/python.python.3.14-3.14.4
- Platform: Windows apps
- Released: Apr 7, 2026
- Priority: High (Closes CVE-2026-4224, high severity)
- CVEs: 7, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Python 3.14](https://patchblox.com/security/data/product/windows-app/python-3.14.md) |  | 3.14.4 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-4224](https://patchblox.com/security/data/cve/CVE-2026-4224.md) | High | Stack overflow parsing XML with deeply nested DTD content models | 7.5 | 0.0072 |  |
| [CVE-2026-3644](https://patchblox.com/security/data/cve/CVE-2026-3644.md) | High | Incomplete control character validation in http.cookies | 7.5 | 0.0051 |  |
| [CVE-2026-4519](https://patchblox.com/security/data/cve/CVE-2026-4519.md) | High | webbrowser.open() allows leading dashes in URLs | 7.1 | 0.0032 |  |
| [CVE-2026-3479](https://patchblox.com/security/data/cve/CVE-2026-3479.md) | Routine | pkgutil.get_data() does not enforce documented restrictions | 0.0 | 0.0025 |  |
| [CVE-2026-2297](https://patchblox.com/security/data/cve/CVE-2026-2297.md) | Routine | SourcelessFileLoader does not use io.open_code() | 5.7 | 0.0022 |  |
| [CVE-2026-3446](https://patchblox.com/security/data/cve/CVE-2026-3446.md) | Routine | Base64 decoding stops at first padded quad by default | 6.0 | 0.0019 |  |
| [CVE-2025-13462](https://patchblox.com/security/data/cve/CVE-2025-13462.md) | Routine | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling | 3.3 | 0.0017 |  |

---

Data as of 2026-11-07T00:32:44Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo