Python issues expedited releases blocking compromised eMudhra CA keys

Python has shipped expedited security releases across five active branches to block compromised eMudhra intermediate certificate authority keys in the ssl module.

The versions are 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18. They address CVE-2026-115557 by distrusting those keys as a last-resort defense. According to release manager Hugo van Kemenade, normal uses of pip, including upgrading pip itself, are now safe from attacks based on the compromised keys even if pip has not been updated yet.

All five also fix CVE-2026-114583, rejecting links that replace the destination under tarfile filtering, and harden http.cookiejar against cookies that carry a negative version. The 3.13, 3.12, and 3.11 lines additionally pick up fixes already present in newer branches, among them an Expat bump covering CVE-2026-77214 and CVE-2026-102633, a Windows mimetypes change for CVE-2024-3220, and a TemporaryDirectory cleanup race fix on some lines.

Binary installers ship for 3.15.2 and 3.14.10; the rest are source-only. Upgrading is recommended for users of the affected versions.