Red Hat CVE-2026-3446

The vulnerability resides in CPython's base64 module, specifically the b64decode() function and related decoding routines. Base64 encoding uses padding characters ('=') to signal the end of encoded data; RFC 4648 mandates that padding only appears at the end of a properly formatted base64 string. The defect causes the decoder to terminate immediately upon finding the first padded quad (a sequence ending with '=' characters), ignoring any subsequent valid base64 data in the input stream. This creates an interoperability issue where CPython accepts truncated or malformed base64 sequences that strictly compliant implementations would reject. The root cause is improper termination logic in the decoding state machine, allowing incomplete or deliberately crafted payloads to bypass validation. The CPE (cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*) identifies all CPython versions as potentially affected, with specific version ranges confirmed vulnerable.