Windows apps · Application version · April 7, 2026

Python 3.13 3.13.13

Python 3.13 3.13.13, released April 7, 2026, fixes 7 CVEs in Python 3.13 (version 3.13.13). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0072

54th percentile

Priority of the 7 CVEs

Patch now 0
                                Urgent 0
                                High 3
                                Routine 4

Applies to

Product	Version
Python 3.13	3.13.13

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-4224	Stack overflow parsing XML with deeply nested DTD content models	7.5	0.0072	None reported
High	CVE-2026-3644	Incomplete control character validation in http.cookies	7.5	0.0051	None reported
High	CVE-2026-4519	webbrowser.open() allows leading dashes in URLs	7.1	0.0032	None reported
Routine	CVE-2026-3479	pkgutil.get_data() does not enforce documented restrictions	0.0	0.0025	None reported
Routine	CVE-2026-2297	SourcelessFileLoader does not use io.open_code()	5.7	0.0022	None reported
Routine	CVE-2026-3446	Base64 decoding stops at first padded quad by default	6.0	0.0019	None reported
Routine	CVE-2025-13462	tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling	3.3	0.0017	None reported