# Python 3.13 security updates

The latest version of Python 3.13 is 3.13.17, released October 21, 2026. Patch Radar has 11 security fixes for Python 3.13, closing 57 CVEs. The newest is Python 3.13 3.13.16 (3.13.16), released September 30, 2026. 9 CVEs have no fix yet.

- Web page: https://patchblox.com/security/product/windows-app/python-3.13
- Platform: Windows apps
- Vendor: Python Software Foundation
- Latest version: 3.13.17 (Oct 21, 2026)
- Supported: yes

## CVEs with no fix yet

| CVE | Priority | Title | Status |
|---|---|---|---|
| [CVE-2026-115557](https://patchblox.com/security/data/cve/CVE-2026-115557.md) | Urgent | Distrust compromised intermediate certificates in ssl module | no-fix |
| [CVE-2025-15367](https://patchblox.com/security/data/cve/CVE-2025-15367.md) | High | POP3 command injection in user-controlled commands | no-fix |
| [CVE-2026-12345](https://patchblox.com/security/data/cve/CVE-2026-12345.md) | High | Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory | no-fix |
| [CVE-2024-3220](https://patchblox.com/security/data/cve/CVE-2024-3220.md) | Routine | Default mimetype known files writeable on Windows | no-fix |
| [CVE-2026-103995](https://patchblox.com/security/data/cve/CVE-2026-103995.md) | Routine | Lenient parsing of integers for response body and chunk framing | no-fix |
| [CVE-2026-114583](https://patchblox.com/security/data/cve/CVE-2026-114583.md) | Routine | tar filter allows writing outside destination via empty-named symlink | no-fix |
| [CVE-2026-116566](https://patchblox.com/security/data/cve/CVE-2026-116566.md) | Routine | socket.getaddrinfo() accepts embedded null bytes in host and port | no-fix |
| [CVE-2026-19672](https://patchblox.com/security/data/cve/CVE-2026-19672.md) | Routine | tarfile extraction filter bypass allows creation of directories outside the destination | no-fix |
| [CVE-2026-3087](https://patchblox.com/security/data/cve/CVE-2026-3087.md) | Routine | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs | no-fix |

## Security fixes, newest first

| Fix | Released | Fixed in | Priority | CVEs | Exploited |
|---|---|---|---|---:|---:|
| [Python 3.13 3.13.16](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.16.md) | Sep 30, 2026 | 3.13.16 | Urgent | 7 | 0 |
| [Python 3.13 3.13.15](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.15.md) | Aug 5, 2026 | 3.13.15 | High | 8 | 0 |
| [Python 3.13 3.13.14](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.14.md) | Jun 10, 2026 | 3.13.14 | High | 10 | 0 |
| [Python 3.13 3.13.13](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.13.md) | Apr 7, 2026 | 3.13.13 | High | 7 | 0 |
| [Python 3.13 3.13.12](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.12.md) | Feb 3, 2026 | 3.13.12 | High | 5 | 0 |
| [Python 3.13 3.13.11](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.11.md) | Dec 5, 2025 | 3.13.11 | High | 3 | 0 |
| [Python 3.13 3.13.10](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.10.md) | Dec 2, 2025 | 3.13.10 | High | 3 | 0 |
| [Python 3.13 3.13.6](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.6.md) | Aug 6, 2025 | 3.13.6 | High | 1 | 0 |
| [Python 3.13 3.13.4](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.4.md) | Jun 3, 2025 | 3.13.4 | High | 6 | 0 |
| [Python 3.13 3.13.2](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.2.md) | Feb 4, 2025 | 3.13.2 | High | 2 | 0 |
| [Python 3.13 3.13.1](https://patchblox.com/security/data/fix/windows-app/python.python.3.13-3.13.1.md) | Dec 3, 2024 | 3.13.1 | High | 5 | 0 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo