MediumFix available
python3.11, python3.13 and 1 more products — security advisory
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
- Products
- python3.11, python3.13, python3.14
- Affected versions
- 3.11.2-6, 3.11.2-6+deb12u1, 3.11.2-6+deb12u2, 3.11.2-6+deb12u3, 3.11.2-6+deb12u4, 3.11.2-6+deb12u5, 3.11.2-6+deb12u6, 3.11.2-6+deb12u7, 3.11.2-6+deb12u8, 3.11.2-6+deb12u9, 3.11.3-1, 3.11.3-2, 3.11.4-1, 3.11.5-1, 3.11.5-2, 3.11.5-3, 3.11.6-1, 3.11.6-2, 3.11.6-3, 3.11.6-3~hurd.2, 3.11.7-1, 3.11.7-2, 3.11.8-1, 3.11.8-1.1~exp1, 3.11.8-1.1~exp2, 3.11.8-2, 3.11.8-3, 3.11.8-3+hurd.1, 3.11.9-1, 3.13.11-1, 3.13.12-1, 3.13.5-2, 3.13.5-2+deb13u1, 3.13.6-1, 3.13.7-1, 3.13.8-1, 3.13.9-1, 3.14.0-1, 3.14.0-2, 3.14.0-3, 3.14.0-4, 3.14.0-5, 3.14.0~a7-1, 3.14.0~b1-1, 3.14.0~b2-1, 3.14.0~b3-1, 3.14.0~b4-1, 3.14.0~rc1-1, 3.14.0~rc2-1, 3.14.0~rc3-1, 3.14.2-1, 3.14.3-1, 3.14.3-2, 3.14.3-3, 3.14.3-4, 3.14.3-5
- Fixed versions
- 3.13.14-1, 3.13.5-2+deb13u2, 3.14.4-1
- CVEs
- CVE-2026-3446
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:51 UTC · Revision 2
Source evidence
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
osv:DEBIAN-CVE-2026-3446
python3.11
Fixed versions: Not specified
python3.13
Fixed versions: 3.13.5-2+deb13u2
python3.13
Fixed versions: 3.13.14-1
python3.14
Fixed versions: 3.14.4-1
Complete source record
{
"id": "d3cae7d5cb41193e7aabebf127be4efafb0c2d39bd945f71e8c4f77defee5ead",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-3446",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-3446",
"summary": "When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use \"validate=True\" to enable stricter processing of base64 data.",
"evidence": "osv:DEBIAN-CVE-2026-3446",
"products": [
{
"name": {
"value": "python3.11",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.11.2-6",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u3",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u4",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u5",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u6",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u7",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u8",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u9",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.3-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.3-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.4-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.5-3",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.6-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.6-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.6-3",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.6-3~hurd.2",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.7-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.7-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.8-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.8-1.1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.8-1.1~exp2",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.8-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.8-3",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.8-3+hurd.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.9-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "python3.13",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.13.5-2+deb13u2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "3.13.5-2",
"evidence": "/affected/1/versions"
},
{
"value": "3.13.5-2+deb13u1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "python3.13",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.13.14-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3.13.11-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.12-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.5-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.6-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.7-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.8-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.9-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "python3.14",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.14.4-1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "3.14.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-3",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-4",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-5",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~a7-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b1-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b4-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc1-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-3",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-4",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-5",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2026-3446",
"aliases": [
"DEBIAN-CVE-2026-3446"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python3.11",
"purl": "pkg:deb/debian/python3.11?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.11.2-6",
"3.11.2-6+deb12u1",
"3.11.2-6+deb12u2",
"3.11.2-6+deb12u3",
"3.11.2-6+deb12u4",
"3.11.2-6+deb12u5",
"3.11.2-6+deb12u6",
"3.11.2-6+deb12u7",
"3.11.2-6+deb12u8",
"3.11.2-6+deb12u9",
"3.11.3-1",
"3.11.3-2",
"3.11.4-1",
"3.11.5-1",
"3.11.5-2",
"3.11.5-3",
"3.11.6-1",
"3.11.6-2",
"3.11.6-3",
"3.11.6-3~hurd.2",
"3.11.7-1",
"3.11.7-2",
"3.11.8-1",
"3.11.8-1.1~exp1",
"3.11.8-1.1~exp2",
"3.11.8-2",
"3.11.8-3",
"3.11.8-3+hurd.1",
"3.11.9-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3446.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.5-2+deb13u2"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.13.5-2",
"3.13.5-2+deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3446.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.14-1"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.13.11-1",
"3.13.12-1",
"3.13.5-2",
"3.13.6-1",
"3.13.7-1",
"3.13.8-1",
"3.13.9-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3446.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.4-1"
}
]
}
],
"package": {
"name": "python3.14",
"purl": "pkg:deb/debian/python3.14?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.14.0-1",
"3.14.0-2",
"3.14.0-3",
"3.14.0-4",
"3.14.0-5",
"3.14.0~a7-1",
"3.14.0~b1-1",
"3.14.0~b2-1",
"3.14.0~b3-1",
"3.14.0~b4-1",
"3.14.0~rc1-1",
"3.14.0~rc2-1",
"3.14.0~rc3-1",
"3.14.2-1",
"3.14.3-1",
"3.14.3-2",
"3.14.3-3",
"3.14.3-4",
"3.14.3-5"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3446.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-27T10:01:05.878125496Z",
"provider": "osv",
"upstream": [
"CVE-2026-3446"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-3446"
]
},
"related_cves": [
{
"value": "CVE-2026-3446",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 461369,
"published_at": "2026-04-10T19:16:26.22+00:00"
}