Python 3.11.18

Release date: Oct. 25, 2026

This is a security release of Python 3.11

Python 3.11.18 is a security update for the legacy 3.11 series. Python 3.15 is the current feature release series.

This expedited release addresses the eMudhra/emSign certificate incident. The ssl module now rejects certificate chains using the compromised intermediate CA keys. This protects normal pip operations, including upgrading pip, when using this Python release, even with an older version of pip.

Security content in this release

• CVE-2026-115557, gh-160040: Reject compromised eMudhra intermediate CA keys.
• CVE-2026-77214, CVE-2026-102633, gh-158876: Upgrade bundled Expat to 2.9.0.
• CVE-2024-3220, gh-159428: Use the Windows registry for default MIME configuration instead of reading mimetypes.knownfiles.
• CVE-2026-114583, gh-160097: Prevent tarfile.tar_filter from accepting links that replace the extraction destination.
• gh-87720: Correct quoting during email header folding in an additional encoded-word case.
• gh-160300: Reject cookies with negative versions in http.cookiejar, preventing domain-validation checks from being bypassed.

No installers

Under PEP 664, Python 3.11 receives source-only security updates on an as-needed basis until October 2027. Regular bugfix updates and binary installers ended with Python 3.11.9.

Full Changelog

Full Changelog