CVE-2026-3446
published 2026-04-10CVE-2026-3446: When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was…
PriorityP431medium6CVSS 4.0
AVNACHATPPRLUINVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.19%
8.6th percentile
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| python_software_foundation | cpython | < 3.13.13 | 3.13.13 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.4 | 3.14.4 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0a8 | 3.15.0a8 |
CVSS provenance
nvdv4.06.0MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
python: Python base64: Incomplete data decoding due to premature stop at padding
vendor_redhat·2026-04-10·CVSS 6.0
CVE-2026-3446 [MEDIUM] CWE-1286 python: Python base64: Incomplete data decoding due to premature stop at padding
python: Python base64: Incomplete data decoding due to premature stop at padding
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
A flaw was found in the Python base64 module. When decoding base64 data using functions like base64.b64decode(), the decoding process prematurely stops upon encountering the first padding character. This can result in incomplete data being processed, where any information following the initial padding is unexpectedly ignored. Consequently, applications might
GHSA
GHSA-8r9f-h969-mm4m: When calling base64
ghsa_unreviewed·2026-04-10
CVE-2026-3446 [MEDIUM] GHSA-8r9f-h969-mm4m: When calling base64
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
VulDB
Python CPython up to 3.13.12/3.14.3/3.15.0a7 b64decode
vuldb·2026-04-10·CVSS 6.0
CVE-2026-3446 [MEDIUM] Python CPython up to 3.13.12/3.14.3/3.15.0a7 b64decode
A vulnerability, which was classified as problematic, was found in Python CPython up to 3.13.12/3.14.3/3.15.0a7. Affected by this issue is the function b64decode. Such manipulation leads to an unknown weakness.
This vulnerability is listed as CVE-2026-3446. The attack may be performed from remote. There is no available exploit.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0ehttps://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fahttps://github.com/python/cpython/issues/145264https://github.com/python/cpython/pull/145267https://mail.python.org/archives/list/[email protected]/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/
2026-04-10
Published