PT-2026-32017 · Python · Base64

Serhiy Storchaka · Published 2026-04-10 · Updated 2026-05-01 · CVE-2026-3446

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Base64 (affected versions not specified)

Description The decoding process using base64.b64decode() or related functions would halt upon encountering the first padded quad, even if additional data remained. This could result in the acceptance of data that might be handled differently by other implementations. Using "validate=True" enables stricter base64 data processing.

Recommendations Utilize "validate=True" when calling base64.b64decode() or related functions to enforce stricter base64 data processing.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BIT-LIBPYTHON-2026-3446

BIT-PYTHON-2026-3446

BIT-PYTHON-MIN-2026-3446

CVE-2026-3446

ECHO-9EDA-DA65-C052

OPENSUSE-SU-2026:10579-1

OPENSUSE-SU-2026:10580-1

OPENSUSE-SU-2026:10667-1

PSF-2026-16

RHSA-2026:10118

RHSA-2026:7443

RHSA-2026:7661

SUSE-SU-2026:1503-1

Affected Products

Base64

References · 34

• https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e · Patch
• https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474 · Patch
• https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa · Patch
• https://github.com/python/cpython/pull/145267 · Patch
• https://mail.python.org/archives/list/[e-mail]/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10580-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3446 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1503-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-3446 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10579-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3446 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-2026-3446 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-3446 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-3446 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10667-1 · Vendor Advisory