Python 3.14.7 Released: What's in the Changelog

Python 3.14.7, the seventh maintenance release of the 3.14 series, was released on August 5, 2026. It contains around 499 bug fixes, build improvements, and documentation changes from 86 contributors since 3.14.6. This is a maintenance release, so the focus is on security and stability rather than new features. Here are the most notable entries from the release notes.

Security

• Fixed quadratic complexity in html.parser.HTMLParser when incrementally parsing long unterminated constructs, which could be exploited for denial of service.
• xml.etree.ElementTree's findall(), iterfind(), and find() now avoid quadratic behavior with XPath index predicates on documents with many same-tag siblings.
• Bundled libexpat updated to version 2.8.2.
• Fixed a tarfile vulnerability where crafted archives could create a symlink pointing outside the destination directory — a bypass of CVE-2025-4330.
• http.client now limits chunked-response trailer lines and skipped 1xx responses to 100 each, preventing a malicious server from hanging the client (GHSA-w4q2-g22w-6fr4).
• imaplib now rejects NUL, CR, and LF characters in IMAP commands, and configparser normalizes line endings when writing multi-line values.

Core and Builtins

• Numerous crash fixes covering out-of-memory paths in compile(), exec(), eval(), ast.parse(), type(), contextvars, and interpreter channels — now raising proper MemoryError instead of dereferencing NULL.
• Multiple free-threaded data-race fixes, including function attribute assignment, enumerate.__reduce__, types.GenericAlias parameters, and asyncio.Task deallocation.
• Fixed an out-of-bounds access in reverse dictionary iterators when the dict is cleared and modified after the iterator is created.

Library

• Bumped bundled pip in ensurepip to 26.2.1.
• argparse now preserves the program name from sys.argv[0] when a named module runs as main without replacing it.
• Fixed exponential and quadratic time in csv.Sniffer.sniff() for samples with many quote characters or quoted fields.
• The pickle C accelerator now enforces frame boundaries when unpickling, matching the pure-Python implementation.
• Many asyncio, tkinter, zoneinfo, imaplib, curses, and datetime fixes, including a ProcessPoolExecutor deadlock with max_tasks_per_child present since Python 3.11.

Build, Platforms, and IDLE

• Windows and macOS builds updated to Tcl/Tk 9.0.4.
• On Linux with the musl C library, Python now uses a thread stack size of at least 1 MiB instead of musl's 128 KiB default.
• Several IDLE fixes, including UTF-8 config/breakpoint files and support for rendering BaseExceptionGroup.

For the complete list, see the official Python 3.14.7 changelog. Happy upgrading.