DockerState

Home › Language runtimes › python › 3.14

python:3.14

The CPython interpreter with pip, tag 3.14, built on Debian 13.7 (trixie). Pushed to Docker Hub 4 days ago.

Critical 16High 458Medium 1497Low 1859Unknown 41Starts as root8 platforms

416 MBdownload (compressed)
1,144 MBunpacked on disk
7filesystem layers
488packages
26,047files
docker pull python:3.14python@sha256:22caa054c0d309b1eee6f448326a8821a674a75b98653247fe706db90491fc87

Size per platform

Compressed download size on Docker Hub for each architecture.

  • riscv64502 MB
  • i386424 MB
  • ppc64le422 MB
  • amd64416 MB
  • arm64405 MB
  • s390x388 MB
  • arm/v5378 MB
  • arm/v7360 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

  • /usr/lib/x86_64-linux-gnu415 MB
  • /usr/bin119 MB
  • /usr/libexec/gcc105 MB
  • /usr/share/locale94 MB
  • /usr/local/lib77 MB
  • /usr/share/doc51 MB
  • /usr/lib/gcc26 MB
  • /usr/lib/python326 MB
  • /usr/lib/python3.1326 MB
  • /usr/lib/git-core25 MB

Layers

The 7 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

Full build steps
  1. 49 MB# debian.sh --arch 'amd64' out/ 'trixie' '@1793059200'
  2. 26 MBRUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends ca-certificates curl gnupg netbase sq wget ; apt-get dist-clean # buildkit
  3. 68 MBRUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends git mercurial openssh-client subversion procps ; apt-get dist-clean # buildkit
  4. 237 MBRUN /bin/sh -c set -ex; apt-get update; apt-get install -y --no-install-recommends autoconf automake bzip2 default-libmysqlclient-dev dpkg-dev file g++ gcc imagemagick libbz2-dev libc6-dev libcurl4-openssl-dev libdb-dev libevent-dev libffi-dev libgdbm-dev libglib2.0-dev libgmp-dev libjpeg-dev libkrb5-dev liblzma-dev libmagickcore-dev libmagickwand-dev libmaxminddb-dev libncurses5-dev libncursesw5-dev libpng-dev libpq-dev libreadline-dev libsqlite3-dev libssl-dev libtool libwebp-dev libxml2-dev libxslt-dev libyaml-dev m
  5. 6.1 MBRUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends libbluetooth-dev tk-dev uuid-dev ; apt-get dist-clean # buildkit
  6. 30 MBRUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends libzstd-dev ; wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; echo "$PYTHON_SHA256 *python.tar.xz" | sha256sum -c -; mkdir -p /usr/src/python; tar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; rm python.tar.xz; cd /usr/src/python; gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; ./configure --build="$gnuArch" --enable-loadable-sqlite-extensio
  7. 251 BRUN /bin/sh -c set -eux; for src in idle3 pip3 pydoc3 python3 python3-config; do dst="$(echo "$src" | tr -d 3)"; [ -s "/usr/local/bin/$src" ]; [ ! -e "/usr/local/bin/$dst" ]; ln -svT "$src" "/usr/local/bin/$dst"; done # buildkit

Known vulnerabilities

16Critical0 with a fix
458High161 with a fix
1497Medium262 with a fix
1859Low53 with a fix
41Unknown0 with a fix

3871 findings across 488 packages; 476 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

SeverityVulnerabilityAffected packagesFixed in
Critical CVE-2026-42216OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
Critical CVE-2026-42217OpenEXR: OpenEXR: Information disclosure via malformed EXR image file processing libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
Critical CVE-2026-44172mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() libmariadb-dev, libmariadb-dev-compat, libmariadb3, mariadb-commoninstalled 1:11.8.6-0+deb13u1 no fix yet
Critical CVE-2026-49261mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd libmariadb-dev, libmariadb-dev-compat, libmariadb3, mariadb-commoninstalled 1:11.8.6-0+deb13u1 no fix yet
Critical CVE-2026-60002openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side openssh-clientinstalled 1:10.0p1-7+deb13u4 no fix yet
Critical CVE-2026-6653libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free libxml2, libxml2-devinstalled 2.12.7+dfsg+really2.9.14-2.1+deb13u3 no fix yet
Critical CVE-2026-99083kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate() linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-47273setuptools: Path Traversal Vulnerability in setuptools PackageIndex setuptoolsinstalled 70.3.0 78.1.1
High CVE-2026-106565ImageMagick: ImageMagick: Denial of Service via missing end-of-file check in bzip2 images imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106567ImageMagick: ImageMagick: Denial of Service via crafted PSD file imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106573ImageMagick: ImageMagick: Denial of Service via missing limit check in MVG decoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106576ImageMagick: ImageMagick: Denial of Service via crafted XMP profile imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106578ImageMagick: ImageMagick: Denial of Service via invalid memory free in MVG decoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106579ImageMagick: ImageMagick: Information disclosure via security policy bypass imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106580ImageMagick: ImageMagick: Information disclosure via missing security policy check in CUT encoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-107209ImageMagick: ImageMagick: Denial of Service via crafted RSVG image imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-114613msgpack: msgpack: Denial of Service via memory leak during map deserialization msgpackinstalled 1.1.2 1.2.3
High CVE-2026-86420ImageMagick: ImageMagick: Denial of Service due to memory budget exhaustion imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-86421ImageMagick: ImageMagick: Denial of Service via memory leak in MSL decoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-93589ImageMagick: ImageMagick: Denial of Service via division by zero in FLIF encoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-93590ImageMagick: ImageMagick: Denial of Service via UHDR encoder policy bypass imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-97687urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override urllib3installed 2.7.0 2.8.0
High CVE-2026-97689urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser urllib3installed 2.7.0 2.8.0
High GHSA-6v7p-g79w-8964MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error msgpackinstalled 1.1.2 1.2.1
High CVE-2013-7445kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2019-19449kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2019-19814kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2021-3847kernel: low-privileged user privileges escalation linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2021-3864kernel: descendant's dumpable setting with certain SUID binaries linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2023-44431bluez: AVRCP stack-based buffer overflow remote code execution vulnerability libbluetooth-dev, libbluetooth3installed 5.82-1.1 no fix yet
High CVE-2024-21803kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2024-58015kernel: wifi: ath12k: Fix for out-of bound access error linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-12495OpenEXR: OpenEXR: Remote Code Execution via malicious EXR file parsing libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
High CVE-2025-12839OpenEXR: OpenEXR: Remote Code Execution via Heap-based Buffer Overflow in EXR File Parsing libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
High CVE-2025-12840OpenEXR: OpenEXR: Remote Code Execution via EXR file parsing heap-based buffer overflow libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
High CVE-2025-38137kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-38187kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-38421kernel: platform/x86/amd: pmf: Use device managed allocations linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-38636kernel: rv: Use strings in da monitors tracepoints linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-39859kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog linux-libc-devinstalled 6.12.113-1 no fix yet

Showing the 40 most severe of 1,481 distinct vulnerabilities (3871 findings, one per affected package).

Packages

Debian packages
469
Python packages
19

Image configuration

Base OS
Debian 13.7 (trixie)
Default user
root (no USER set; the entrypoint may still drop privileges)
Entrypoint
—
Command
python3
Exposed ports
none
Image created
2026-10-28
amd64 digest
sha256:faf7953db05ee8e060aa9fda8a389e5779cdba26a22e1363379861023e910830

Other Python tags

python:3.14-slim124 MB unpacked · 44 MB downloadH 49M 62L 62? 1 python:3.14-alpine50 MB unpacked · 18 MB downloadH 5M 2L 1

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:faf7953db05e. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.