https://seclists.org/oss-sec/2026/q4/331: Python 3.15.1, 3.14.9 and 3.13.17 aout
Published Oct 22, 2026
·Updated
Affected Software
3 affected components
Python Software Foundation Python=3.15.1, =3.14.9, =3.13.17
pypi/pip=26.2.2
pypi/certifi=2026.10.19
Frequently Asked Questions
1
Which installations need attention beyond updating the system Python?
Existing virtual environments need their own updates: upgrade both pip and uv to the latest versions. Updating a bundled pip in a newly installed Python release does not by itself update pip in pre-existing virtual environments.
2
What should teams do if they cannot immediately install one of these Python releases?
For a Python 3.15 macOS installation, the advisory states that certificates and pip can be upgraded separately. The provided secure pip upgrade command installs pip 26.2.2 from a pinned PyPI URL with a SHA-256 hash.
3
Why is pip being updated in these releases?
The bundled pip is updated to version 26.2.2, which includes certifi 2026.10.19 to address the eMudhra / emSign CA certificate security incident. Python 3.13 received a special security release with installers despite being in security-only mode.