| Name | CVE-2026-3446 |
| Description | When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| python2.7 (PTS) | bullseye | 2.7.18-8+deb11u1 | vulnerable |
| python3.11 (PTS) | bookworm | 3.11.2-6+deb12u8 | vulnerable |
| bookworm (security) | 3.11.2-6+deb12u3 | vulnerable |
| python3.13 (PTS) | trixie | 3.13.5-2+deb13u3 | fixed |
| forky, sid | 3.13.14-1 | fixed |
| python3.14 (PTS) | forky, sid | 3.14.6-1 | fixed |
| python3.9 (PTS) | bullseye | 3.9.2-1 | vulnerable |
| bullseye (security) | 3.9.2-1+deb11u7 | vulnerable |
The information below is based on the following data on fixed versions.
Notes
[bookworm] - python3.11 <ignored> (Not backported to older Python releases due to compat concerns)
[bullseye] - python3.9 <ignored> (Not backported to older Python releases due to compat concerns)
[bullseye] - python2.7 <end-of-life> (limited support in bullseye)
https://mail.python.org/archives/list/security-announce@python.org/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/
https://github.com/python/cpython/issues/145264
https://github.com/python/cpython/pull/145267
Fixed by: https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e (v3.15.0a8)
Fixed by: https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa (v3.14.4)
Fixed by: https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474 (v3.13.13)
Risk for broken compatibility concerns for older versions, thus will not be backported upstream:
https://github.com/python/cpython/issues/145264#issuecomment-4409789500