Python 3.10.22 ends five years of security fixes for the 3.10 series

On the day it ships, 3.10.22 has every CVE fix in this sweep ^[1]. That includes an XML hash-flooding protection for xml.parsers.expat and xml.etree.ElementTree ^[17], which 3.11 already received in 3.11.16 ^[20]. The release notes put it plainly: "If you are still using Python 3.10, please plan your upgrade to a supported version." ^[18]

Three of the fixes touch the same code, tarfile's extraction filters ^[2]. One closes a hole where hard links to symbolic links could expose files outside the destination and change their permissions or modification times ^[10]. The second stops a path that leaves the destination and comes back from creating directories outside it ^[11]. The third makes the filters apply when a link falls back to extracting an archive member ^[12]. If a fourth turns up, 3.11 can still get a fix and 3.10 will not ^[2][3].

The source-only releases leave two security dependencies to whoever builds them. They do not bundle OpenSSL ^[16], so TLS fixes come from the library the build links against. The new XML protection works only when Python is compiled with libexpat 2.8.0 or later ^[17]. The bundled libexpat is now 2.8.5 ^[15], so only builds linked against an older system copy miss the protection.

One fix is partial. CVE-2026-15310 bounds zipfile decompression per read for bzip2 and LZMA members, so small compressed members can no longer force unbounded allocations ^[13]. Code that monkey-patches _get_decompressor() with a third-party decompressor that lacks needs_input and a two-argument decompress() is still vulnerable after the upgrade ^[13].

The ssl fix is careful release engineering. Under CVE-2026-19553, ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments, and asyncio also validates the TLS server_hostname ^[8]. If a patch release started raising errors on a missing hostname, TLS clients that worked the day before would break. So when check_hostname is enabled and the hostname is missing, 3.10 through 3.12 emit a DeprecationWarning, and 3.13 and later raise ValueError ^[9]. That makes a 3.10.22 test run useful before a jump to 3.13. Each of those warnings marks a call that 3.13 will reject ^[9].

Python 3.10 got five years of security support ^[2]. The release notes started the series with a trip inside a Schwarzschild black hole, and they end it with the ringdown of a black hole formed in a merger ^[19].