Python 3.12.15

Release date: Sept. 30, 2026

This is a security release of Python 3.12

Note: The release you're looking at is Python 3.12.15, a security bugfix release for the legacy 3.12 series. Python 3.14 is now the latest feature release series of Python 3. Get the latest release of 3.14.x here.

Security content in this release

• CVE-2026-19445 gh-156293 Use-after-free of a server-side SSLContext when sni_callback switches contexts

• CVE-2026-19553 gh-156793 SSLContext.wrap_bio() missing validation of server_hostname parameter

• CVE-2026-82049 gh-157190 tarfile extraction filters allow file modification and content disclosure via hard link to symlink

• CVE-2026-15310 gh-156002 Memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression

• CVE-2026-19672 gh-155999 tarfile extraction filter bypass allows creation of directories outside the destination

• CVE-2026-15806 gh-155694 urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme

• CVE-2026-17084 gh-155292 StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0

• gh-158446 Reject float format precision near INT_MAX

• gh-157953 Update bundled Expat to 2.8.5

• CVE-2026-87910 gh-157265 tarfile hardlink fallback ignores custom extraction filter rejection via None

No installers

According to the release calendar specified in PEP 693, Python 3.12 is now in the "security fixes only" stage of its life cycle: the 3.12 branch only accepts security fixes, and releases of those are made irregularly in source-only form until October 2028. Python 3.12 isn't receiving regular bug fixes anymore, and binary installers are no longer provided for it. Python 3.12.10 was the last full bugfix release of Python 3.12 with binary installers.

Full Changelog