Python has released expedited security updates for five active versions (3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18) to address a significant compromise involving eight intermediate certificates from the eMudhra CA. The updates include a hardcoded denylist of the compromised certificates in the ssl module, ensuring that pip remains safe to use even before it is updated. In addition to the security fixes, the binary releases contain over a hundred bug fixes, while the source-only versions include patches for various issues. Users are strongly advised to upgrade to pip version 26.2.2 or newer, as older versions still trust the compromised certificates, and the entire Python ecosystem has responded with updates following the disclosure of the vulnerability
Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 Security Updates Fix eMudhra CA Compromise
Python shipped expedited security releases across five active versions, 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18, to address the eMudhra/emSign compromised certificate incident (CVE-2026-115557). The main fix hardcodes a denylist of eight bad intermediate CA keys into the ssl module, making pip safe to use even before the tool itself is updated. Those two binary releases include over a hundred routine bugfixes, while the three source-only tracks add backported patches for the Expat XML parser, a Windows mimetypes issue, and a tempfile race condition. The team strongly recommends upgrading, and getting pip to 26.2.2 or newer remains essential since it trusts its own CA bundle separately from the system store.
