| Name | CVE-2026-3446 |
| Description | When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| pypy3 (PTS) | bullseye | 7.3.5+dfsg-2+deb11u2 | vulnerable |
| bullseye (security) | 7.3.5+dfsg-2+deb11u5 | vulnerable | |
| bookworm | 7.3.11+dfsg-2+deb12u3 | vulnerable | |
| trixie | 7.3.19+dfsg-2 | vulnerable | |
| sid, forky | 7.3.21+dfsg-4 | vulnerable | |
| python2.7 (PTS) | bullseye | 2.7.18-8+deb11u1 | vulnerable |
| python3.11 (PTS) | bookworm | 3.11.2-6+deb12u6 | vulnerable |
| bookworm (security) | 3.11.2-6+deb12u3 | vulnerable | |
| python3.13 (PTS) | trixie | 3.13.5-2 | vulnerable |
| sid, forky | 3.13.12-1 | vulnerable | |
| python3.14 (PTS) | forky | 3.14.3-3 | vulnerable |
| sid | 3.14.4-1 | fixed | |
| python3.9 (PTS) | bullseye | 3.9.2-1 | vulnerable |
| bullseye (security) | 3.9.2-1+deb11u5 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| pypy3 | source | (unstable) | (unfixed) | |||
| python2.7 | source | (unstable) | (unfixed) | |||
| python3.11 | source | (unstable) | (unfixed) | |||
| python3.13 | source | (unstable) | (unfixed) | |||
| python3.14 | source | (unstable) | 3.14.4-1 | |||
| python3.9 | source | (unstable) | (unfixed) |
https://mail.python.org/archives/list/security-announce@python.org/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/
https://github.com/python/cpython/issues/145264
https://github.com/python/cpython/pull/145267
Fixed by: https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e (v3.15.0a8)
Fixed by: https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa (v3.14.4)
Fixed by: https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474 (v3.13.13)