Python 3.13.18

Release date: Oct. 25, 2026

This is a security release of Python 3.13

Note: The release you're looking at is Python 3.13.18, a security bugfix release for the legacy 3.13 series. Python 3.15 is now the latest feature release series of Python 3. Get the latest release of 3.15.x here.

This is an expedited security release to address the compromised eMudhra intermediate CA keys. These keys are now blocked by the ssl module as a last resort against their use. Normal uses of pip, including to upgrade pip itself, are now safe from attacks based on those compromised keys, even if pip hasn't been updated yet.

Security content in this release

• CVE-2026-115557 gh-160040: Distrust compromised eMudhra intermediate CA keys

• CVE-2026-77214 CVE-2026-102633 gh-158876: Update bundled Expat to 2.9.0

• CVE-2024-3220 gh-159428: Don't read mimetypes.knownfiles by default on Windows

• CVE-2026-114583 gh-160097: Reject links replacing the destination in tarfile.tar_filter

• gh-87720: Fix additional header refolding-quoting edge case

• gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory

• gh-160300: Reject cookies with a negative version in http.cookiejar

No installers

According to the release calendar specified in PEP 719, Python 3.13 is now in the "security fixes only" stage of its life cycle: the 3.13 branch only accepts security fixes, and releases of those are made irregularly in source-only form until October 2028. Python 3.13 isn't receiving regular bug fixes anymore, and binary installers are no longer provided for it. Python 3.13.17 was the last bugfix release of Python 3.13 with binary installers.

Full Changelog