Windows apps · Application version · September 30, 2026

Python 3.14 3.14.8

Python 3.14 3.14.8, released September 30, 2026, fixes 5 CVEs in Python 3.14 (version 3.14.8). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

1 rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0073

54th percentile

Priority of the 5 CVEs

Patch now 0
                                Urgent 1
                                High 1
                                Routine 3

Applies to

Product	Version
Python 3.14	3.14.8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-19445	Use-after-free of a server-side SSLContext when sni_callback switches contexts	9.2	0.0052	None reported
High	CVE-2026-19553	SSLContext.wrap_bio() missing validation of server_hostname parameter	7.6	0.0055	None reported
Routine	CVE-2026-17084	stringprep.map_table_b2() deviates from RFC 3454 Table B.2	6.0	0.0073	None reported
Routine	CVE-2026-15806	`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching	6.0	0.0053	None reported
Routine	CVE-2026-15310	zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits	2.1	0.0053	None reported