CVE-2026-3446Disclosure

LOWCVSS 6.0 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-345

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 1d ago at 2 mentions (2026-04-10); latest day: 2
4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

250.0%

General

250.0%

Referenced assets5 URLs

By indicator

Full discourse4 posts

Open Source Security mailing list@oss_security180d
General
CVE-2026-1502: CPython: HTTP client proxy tunnel headers not validated for CR/LF https://www.openwall.com/lists/oss-security/2026/04/11/4 CVE-2026-3446: CPython: Base64 decoding stops at first padded quad by default https://www.openwall.com/lists/oss-security/2026/04/11/5
Post summary
The post announces two new Python CVEs, linking to security mailing‑list discussions, without providing exploits, patches, or detailed technical data.
00080613
4.6K followersView on X
CVE@CVEnew180d
Disclosure
CVE-2026-3446 When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more infor… https://www.cve.org/CVERecord?id=CVE-2026-3446
Post summary
The post announces CVE‑2026‑3446, describing its base64 decoding flaw, and provides a link to the CVE record.
0001094
57.0K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash180d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CPython [CVE-2026-3446] Base64 decoding stops at first padded quad by default Intel Report: https://ift.tt/ax7O5wh
Post summary
The post announces CVE‑2026‑3446, detailing how CPython’s Base64 decoding halts at the first padded quad, and links to an Intel report, but provides no PoC, exploit, patch, or active exploitation evidence.
0000025
280 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds180d
General
CVE-2026-3446 Base64 Decoding Truncation Vulnerability in Padded Quad Processing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3446
Post summary
The snippet references CVE-2026-3446, describing it as a Base64 decoding truncation flaw in padded quad processing, but provides no details on exploitation, patches, or PoC.
0000032
4.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-3446

Open Source Security mailing list@oss_securityGeneral

The post announces two new Python CVEs, linking to security mailing‑list discussions, without providing exploits, patches, or detailed technical data.

CVE@CVEnewDisclosure

The post announces CVE‑2026‑3446, describing its base64 decoding flaw, and provides a link to the CVE record.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The post announces CVE‑2026‑3446, detailing how CPython’s Base64 decoding halts at the first padded quad, and links to an Intel report, but provides no PoC, exploit, patch, or active exploitation evidence.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The snippet references CVE-2026-3446, describing it as a Base64 decoding truncation flaw in padded quad processing, but provides no details on exploitation, patches, or PoC.