Python 3.14.7
The Python Software Foundation released Python 3.14.7 on August 5, 2026, the latest bugfix release in the 3.14 series. The update lands roughly eight weeks after 3.14.6 and is dominated by security hardening, with fixes for denial-of-service vectors in the standard library and a bypass of a previously patched tarfile vulnerability.
What Changed
Seven of the fixes in this release are classified as security-related. The most notable closes a bypass of CVE 2025-4330: crafted archives could previously create a symlink pointing outside the destination directory through the tarfile data and extraction filters, a hole now sealed in gh-151558. The bundled libexpat dependency also moves to version 2.8.2, and http.client now caps chunked-response trailer lines and interim 1xx responses at 100 each, preventing a malicious or broken server from hanging a client indefinitely.
Parsing performance received attention as well. html.parser.HTMLParser no longer exhibits quadratic complexity when incrementally parsing long unterminated constructs such as tags or comments, and the xml.etree.ElementTree findall(), iterfind(), and find() methods avoid quadratic behavior when XPath index predicates like [1] or [last()] are used on documents with many same-tag siblings.
Core and Builtins Fixes
On the interpreter side, the free-threaded build gets a round of correctness fixes, including data races when setting function object attributes, a crash while deallocating asyncio.Task objects, and asyncio.all_tasks() losing eager-started tasks when called from another thread. Standard builds see an out-of-bounds access fix in reverse dictionary iterators, a crash with deeply nested __parameters__ on types.GenericAlias, and a potential SystemError during vector calls that now correctly raises MemoryError instead. A stack limit check also works properly when Python is linked against musl, as on Alpine Linux.
Library Improvements
Several standard library modules are quieter after this update. csv.Sniffer.sniff() no longer takes exponential or quadratic time on adversarial samples, math.isqrt() returns the correct result in a previously failing edge case, and uuid.uuid1() behaves properly on OpenBSD. The C accelerator for zoneinfo, the pure-Python JSON decoder, and logging's race-prone handler cleanup all received fixes, and the pip bundled with ensurepip was bumped to version 26.2.1.
Why It Matters
Python 3.14.7 is a maintenance release with no new features and no deprecations — but the security component is significant. Anyone running a 3.14.x deployment that exposes html.parser, tarfile, or http.client to untrusted input should upgrade promptly, and free-threaded users should treat the race and crash fixes as a strong reason to move off older 3.14 builds.
What's Next
With 3.15.0 now in release candidate stage, the 3.14 series continues in maintenance mode with regular bugfix releases. Python 3.14.7 is available now from python.org downloads and will reach package managers over the coming days.