CVE-2026-3446: Base64 decoding stops at first padded quad by default
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u2 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.4-1 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.10-1 - Configuration
Use validate=True to enable stricter processing of Base64 data and prevent decoding from stopping at the first padded quad.
CPython base64.b64decode() and related functions validate = True
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3446?
CVE-2026-3446 has a medium severity score of 6.
How do I fix CVE-2026-3446?
To mitigate CVE-2026-3446, ensure you are using the latest version of Python where the issue is resolved.
What is the risk associated with CVE-2026-3446?
CVE-2026-3446 has a risk classification of 33, indicating potential data processing vulnerabilities.
What functions are affected by CVE-2026-3446?
CVE-2026-3446 affects the base64.b64decode() function and related decoding methods.
How does CVE-2026-3446 affect data processing?
CVE-2026-3446 allows for data to be improperly accepted and processed if it stops decoding at the first padded quad.