CVE-2026-3446 Base64 decoding stops at first padded quad by default
Base64 decoding stops early on padded quads, potentially allowing data acceptance discrepancies with other implementations unless strict validation is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3446?
CVE-2026-3446 is a medium-severity vulnerability in CPython, published on 10 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
Weakness: CWE-345
Which versions are affected by CVE-2026-3446?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.13.13, 3.14.4 |
python Bitnami | All versions | 3.13.13, 3.14.4 |
python-min Bitnami | All versions | 3.13.13, 3.14.4 |
Linux distribution packages (15)
python3.11 Red Hat:hummingbird:1 | All versions | 0:3.11.16-1.1.hum1 |
python3.11-debug Red Hat:hummingbird:1 | All versions | 0:3.11.16-1.1.hum1 |
python3.11-devel Red Hat:hummingbird:1 | All versions | 0:3.11.16-1.1.hum1 |
python3.11-idle Red Hat:hummingbird:1 | All versions | 0:3.11.16-1.1.hum1 |
python3.11-libs Red Hat:hummingbird:1 | All versions | 0:3.11.16-1.1.hum1 |
python3.11-test Red Hat:hummingbird:1 | All versions | 0:3.11.16-1.1.hum1 |
python3.11-tkinter Red Hat:hummingbird:1 | All versions | 0:3.11.16-1.1.hum1 |
python SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 2.7.18-150000.117.1 |
python-base SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 2.7.18-150000.117.1 |
python311 SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.11.15-150400.9.88.1 |
python311-core SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.11.15-150400.9.88.1 |
python36 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.6.15-111.1 |
python36-core SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.6.15-111.1 |
python310 openSUSE:Tumbleweed | All versions | 3.10.20-5.1 |
python315 openSUSE:Tumbleweed | All versions | 3.15.0~a8-2.1 |
How do I fix CVE-2026-3446?
Upgrade libpython to a fixed version for your release line: 3.13.13 or 3.14.4.
Is CVE-2026-3446 being exploited?
There is no known exploitation of CVE-2026-3446 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-3446, BIT-libpython-2026-3446, BIT-python-2026-3446, BIT-python-min-2026-3446, DEBIAN-CVE-2026-3446, ECHO-9eda-da65-c052 and 19 more.