# Python 3.14 3.14.5

Python 3.14 3.14.5, released May 10, 2026, fixes 7 CVEs in Python 3.14 (version 3.14.5). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/windows-app/python.python.3.14-3.14.5
- Platform: Windows apps
- Released: May 10, 2026
- Priority: High (Closes CVE-2026-6100, high severity)
- CVEs: 7, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Python 3.14](https://patchblox.com/security/data/product/windows-app/python-3.14.md) |  | 3.14.5 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-6100](https://patchblox.com/security/data/cve/CVE-2026-6100.md) | High | Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure | 9.1 | 0.0058 |  |
| [CVE-2026-3298](https://patchblox.com/security/data/cve/CVE-2026-3298.md) | High | Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes | 8.8 | 0.0039 |  |
| [CVE-2026-4786](https://patchblox.com/security/data/cve/CVE-2026-4786.md) | High | Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() | 7.1 | 0.0029 |  |
| [CVE-2026-1502](https://patchblox.com/security/data/cve/CVE-2026-1502.md) | Routine | HTTP client proxy tunnel headers not validated for CR/LF | 5.7 | 0.0056 |  |
| [CVE-2026-3087](https://patchblox.com/security/data/cve/CVE-2026-3087.md) | Routine | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs | 6.0 | 0.0055 |  |
| [CVE-2026-6019](https://patchblox.com/security/data/cve/CVE-2026-6019.md) | Routine | BaseCookie.js_output() does not neutralize embedded characters | 6.8 | 0.0021 |  |
| [CVE-2026-5713](https://patchblox.com/security/data/cve/CVE-2026-5713.md) | Routine | Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target | 6.0 | 0.0013 |  |

---

Data as of 2026-11-07T00:32:44Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo