Executive brief
A vulnerability in Python's standard library could allow attackers to bypass data validation checks. The base64 decoding component, which is commonly used to process encoded data in web applications and APIs, incorrectly stops processing after encountering certain characters, potentially ignoring malicious data appended to the end of a message. This discrepancy can lead to security risks if different systems interpret the same piece of data in different ways.
Technical details
A vulnerability exists in Python's base64 and binascii modules (specifically b64decode and a2b_base64) where the decoder stops processing after the first padded quad ('=') even if additional data follows. This behavior deviates from RFC 4648 and can lead to 'Insufficient Verification of Data Authenticity' (CWE-345). An attacker could exploit this to hide data or bypass security filters that use different base64 implementations. The issue is addressed by ensuring the decoder no longer ignores excess data in non-strict mode and by recommending the use of 'validate=True' for stricter processing. Patches have been applied to CPython versions 3.13 and 3.14.
Affected products
- Python Software Foundation CPython 3.13, 3.14
Timeline
- 2026-02-26: other: Issue first reported and pull request opened in CPython repository
- 2026-03-22: patched: Fix merged into CPython main branch
- 2026-04-10: disclosed: CVE published and announced by Python Software Foundation
References
- https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474
- https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e
- https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa
- https://github.com/python/cpython/issues/145264
- https://github.com/python/cpython/pull/145267
- https://mail.python.org/archives/list/security-announce@python.org/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/