BIT-python-min-2026-3446: Base64 decoding stops at first padded quad by default

Published Apr 10, 2026

Updated

When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.

Affected Software

1 affected component

Python Software Foundation Python

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Pass validate=True when decoding Base64 data to enable stricter processing and prevent decoding from stopping at the first padded quad while additional data remains.
Python base64.b64decode() and related functions validate = True

Event History

Apr 10, 2026

CVE Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionSeverity

Frequently Asked Questions

What applications are most exposed to this issue?

Applications that decode Base64 input and rely on the decoded result for validation, authorization, signature handling, or interoperability decisions are exposed when other components process trailing data differently. The risk is greatest where Base64 input comes from a less-trusted source.

What does an attacker need to exploit this behavior?

An attacker needs to supply Base64 data containing a padded quad followed by additional information. Exploitation depends on the application accepting the Python-decoded result while another implementation or processing step interprets the same input differently.

Are default Base64 decoding calls affected?

Yes. The described behavior occurs by default when using base64.b64decode() or related functions, because decoding stops at the first padded quad.

What can be done if patching is not immediately possible?

Use validate=True when decoding Base64 data to enable stricter processing. Review input-handling paths that use base64.b64decode() or related functions, especially where decoded data is security-sensitive or shared with other implementations.

BIT-python-min-2026-3446: Base64 decoding stops at first padded quad by default

Affected Software

Remediation

Event History

Frequently Asked Questions

What applications are most exposed to this issue?

What does an attacker need to exploit this behavior?

Are default Base64 decoding calls affected?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What applications are most exposed to this issue?

What does an attacker need to exploit this behavior?

Are default Base64 decoding calls affected?

What can be done if patching is not immediately possible?