Windows apps · Application version · September 30, 2026

Python 3.13 3.13.16

Python 3.13 3.13.16, released September 30, 2026, fixes 7 CVEs in Python 3.13 (version 3.13.16). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

1 rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0073

54th percentile

Priority of the 7 CVEs

Patch now 0
                                Urgent 1
                                High 2
                                Routine 4

Applies to

Product	Version
Python 3.13	3.13.16

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-19445	Use-after-free of a server-side SSLContext when sni_callback switches contexts	9.2	0.0052	None reported
High	CVE-2026-19553	SSLContext.wrap_bio() missing validation of server_hostname parameter	7.6	0.0055	None reported
High	CVE-2026-82049	tarfile extraction filters allow file modification and content disclosure via hard link to symlink	8.4	0.0019	None reported
Routine	CVE-2026-17084	stringprep.map_table_b2() deviates from RFC 3454 Table B.2	6.0	0.0073	None reported
Routine	CVE-2026-87910	tarfile hardlink fallback ignores custom extraction filter rejection via None	5.7	0.0061	None reported
Routine	CVE-2026-15806	`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching	6.0	0.0053	None reported
Routine	CVE-2026-15310	zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits	2.1	0.0053	None reported