Release Date: Oct. 31, 2025

This is a security release of Python 3.9

Note: The release you're looking at is Python 3.9.25, a security bugfix release for the legacy 3.9 series. Python 3.14 is now the latest feature release series of Python 3. Get the latest release of 3.14.x here.

Security content (low severity)

• gh-136063: email.message: ensured linear complexity for legacy HTTP parameters parsing.
• gh-136065: Fixed quadratic complexity in os.path.expandvars().
• gh-120384: Fixed an array out of bounds crash in list_ass_subscript, which could be invoked via some specificly tailored input: including concurrent modification of a list object, where one thread assigns a slice and another clears it.
• gh-120298: Fixed use-after free in list_richcompare_impl which can be invoked via some specificly tailored evil input.
• gh-98793: Fixed argument typechecks in _overlapped.WSAConnect() and _overlapped.Overlapped.WSASendTo() functions that could lead to a crash.
• gh-137836: html.parser.HTMLParser: Added support of the “plaintext” element, RAWTEXT elements “xmp”, “iframe”, “noembed” and “noframes”, and optionally RAWTEXT element “noscript”.

Other notable changes

• gh-136755: Fixed a regression in ntpath.realpath() introduced in 3.9.23 as part of the tarfile filter bypass fixes.

No installers

According to the release calendar specified in PEP 596, Python 3.9 is now in the "security fixes only" stage of its life cycle: the 3.9 branch only accepts security fixes and releases of those are made irregularly in source-only form until the end of October 2025. Python 3.9 isn't receiving regular bug fixes anymore, and binary installers are no longer provided for it. Python 3.9.13 was the last full bugfix release of Python 3.9 with binary installers.

Full Changelog