CVE-2026-3446
Published: April 14, 2026Last modified: August 24, 2026
Description
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
Notes
From python maintainers: > The issue looked like potential security issue, but we did not have real examples of possible attacks, so it was not classified as security issue. This change can potentially break the user code (and it turned out that it really breaks the user code), so it was safer to only apply it to maintained versions. ... - https://github.com/python/cpython/issues/145264#issuecomment-4409789500
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | python3 | Will not fix (3.11.3-r0) |
| 25 LTS | python3 | Will not fix (3.12.10-r1) | |
| Stream | python3 | Fixed (3.14.3-r1) | |
| Hardened Containers | 23 LTS | python3 | Will not fix (3.11.3-r0) |
| 25 LTS | python3 | Will not fix (3.12.10-r1) | |
| Stream | python3 | Fixed (3.14.3-r1) |
References
- https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474
- https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e
- https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa
- https://github.com/python/cpython/issues/145264
- https://github.com/python/cpython/pull/145267
- https://mail.python.org/archives/list/[email protected]/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/