Medium severity · published Apr 10, 2026
CVE-2026-3446
Base64 decoding stops at first padded quad by default
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.13.13; 3.14.0 before 3.14.4; 3.15.0a1 before 3.15.0a8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3446
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3446
github.com
https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474
github.com
https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e
github.com
https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa
github.com
https://github.com/python/cpython/issues/145264
github.com
https://github.com/python/cpython/pull/145267
mail.python.org
https://mail.python.org/archives/list/security-announce@python.org/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.4
CVE-2026-82049
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
8.2
CVE-2026-11972
tarfile opened in streaming mode mishandles EOF