BIT-python-2026-3446: Base64 decoding stops at first padded quad by default

Published Apr 10, 2026

Updated

When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.

Affected Software

1 affected component

Python Software Foundation Python

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Call base64.b64decode() or related functions with validate=True to enable stricter processing of base64 data.
Python base64.b64decode() and related functions validate = True

Event History

Apr 10, 2026

CVE Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionSeverity

Frequently Asked Questions

What applications are most exposed to this behavior?

Applications that accept Base64 input from less-trusted sources and pass it to base64.b64decode() or related functions without strict validation are exposed to inconsistent interpretation of data after a padded quad. This is particularly relevant when another component or implementation processes the same Base64 value differently.

What must an attacker be able to do to exploit this issue?

An attacker needs to provide Base64-encoded input that contains a padded quad followed by additional data, and the application must decode it using the default non-strict behavior. Successful exploitation also depends on the application relying on the decoded result while another implementation treats the supplied value differently.

Is the default decoding behavior affected, and what is the mitigation?

Yes. By default, decoding stops at the first padded quad even if additional input remains. Use validate=True with base64.b64decode() or related decoding functions to enable stricter Base64 processing.

BIT-python-2026-3446: Base64 decoding stops at first padded quad by default

Affected Software

Remediation

Event History

Frequently Asked Questions

What applications are most exposed to this behavior?

What must an attacker be able to do to exploit this issue?

Is the default decoding behavior affected, and what is the mitigation?

Company

Resources

Contact

Frequently Asked Questions

What applications are most exposed to this behavior?

What must an attacker be able to do to exploit this issue?

Is the default decoding behavior affected, and what is the mitigation?