CVE-2026-3446
MEDIUMBase64 decoding stops at first padded quad by default
Title source: cnaDescription
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
References (6)
Core 6
Core References
Vendor Advisory vendor-advisory
https://mail.python.org/archives/list/[email protected]/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/
Patch patch
https://github.com/python/cpython/pull/145267
Issue Tracking issue-tracking
https://github.com/python/cpython/issues/145264
Scores
CVSS v4
6.0
EPSS
0.0019
EPSS Percentile
8.6%
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-345
Status
published
Products (3)
Python Software Foundation/CPython
< 3.13.13
Python Software Foundation/CPython
3.14.0 - 3.14.4
Python Software Foundation/CPython
3.15.0a1 - 3.15.0a8
Published
Apr 10, 2026
Tracked Since
Apr 11, 2026