CVE-2026-3446 Details
Description
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
A vulnerability exists in the Python Base64 decoder that can lead to incorrect data processing. When using the `base64.b64decode()` function or similar methods, the decoder stops after the first padded quad, ignoring any additional data. This behavior, which occurs in non-strict mode, contradicts RFC 4648 guidelines and can cause issues when the decoded data is processed by other implementations. The vulnerability affects Python versions 3.13.0 to 3.13.12, 3.14.0 to 3.14.3, and 3.15.0a1 to 3.15.0a7.
Users can upgrade to Python versions 3.13.13, 3.14.4, or 3.15.0a8, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | New CVE Received | [email protected] |