Windows apps · Application version · May 10, 2026

Python 3.14 3.14.5

Python 3.14 3.14.5, released May 10, 2026, fixes 7 CVEs in Python 3.14 (version 3.14.5). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0058

47th percentile

Priority of the 7 CVEs

Patch now 0
                                Urgent 0
                                High 3
                                Routine 4

Applies to

Product	Version
Python 3.14	3.14.5

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-6100	Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure	9.1	0.0058	None reported
High	CVE-2026-3298	Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes	8.8	0.0039	None reported
High	CVE-2026-4786	Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()	7.1	0.0029	None reported
Routine	CVE-2026-1502	HTTP client proxy tunnel headers not validated for CR/LF	5.7	0.0056	None reported
Routine	CVE-2026-3087	shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs	6.0	0.0055	None reported
Routine	CVE-2026-6019	BaseCookie.js_output() does not neutralize embedded characters	6.8	0.0021	None reported
Routine	CVE-2026-5713	Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target	6.0	0.0013	None reported