Running Python 2.7 in 2026: what is unfixed, and keeping a legacy app alive

Python 2.7 reached its end of life in 2020, and some applications still need it. Newer Linux releases no longer package it, the bugs found since 2020 are not fixed in the last release, and the OpenSSL it was last built against has had no public fixes since 2023. This page sets out where Python 2.7 still comes from, what is unfixed in it, what Nextweb's Python 2.7 package is and is not, and how to install it, from a run on Ubuntu 24.04 on 25 October 2026.

What ended in 2020

PEP 373, Python 2.7's release schedule, says that "The End Of Life date (EOL, sunset date) for Python 2.7 has been moved five years into the future, to 2020", and lists the final release as 2.7.18 on 20 April 2020. Since then Python has published no 2.7 release, so every fix after it exists only where someone else applied it.

Where Python 2.7 still comes from

What each release's own repositories offer, read on 25 October 2026:

The sources are Debian, Ubuntu, and Red Hat, which says "Python 2 is not distributed with RHEL 9." The machine this page's run used, Ubuntu 24.04, has none:

$ apt-cache policy python2
python2:
  Installed: (none)
  Candidate: (none)

Those distribution packages carry the distributions' own patches. Debian's security tracker, for example, shows CVE-2021-3177 fixed in its python2.7 packages, not in 2.7.18 as Python released it.

What is unfixed in 2.7.18

Bugs found in Python since April 2020 that the 2.7.18 code has, among them:

• CVE-2021-3177, a buffer overflow in ctypes when it formats floating-point numbers;
• CVE-2021-23336, web cache poisoning through how query strings are split;
• CVE-2022-0391, in urllib.parse, where a crafted URL leads to injection attacks.

On each tracker the fix arrives as a distribution's patch on top of 2.7.18, after Python's last release. Anything found from now on stays unfixed upstream too.

The other part is OpenSSL. Python 2.7.18's ssl module does not build against OpenSSL 3, so a 2.7 built today uses OpenSSL 1.1.1, and OpenSSL says that "OpenSSL 1.1.1 has reached its EOL as of today, 11th September 2023", and that "it will no longer receive publicly available security fixes."

The options

• A release that still packages it. Debian 11, or Ubuntu 20.04 or 22.04, with the distribution's patched 2.7, for as long as that release gets updates.
• A container from such a release, for a machine that runs a newer one.
• Building 2.7.18 from source, against OpenSSL 1.1.1 and with none of the distributions' patches unless you apply them.
• A portable build that brings its own libraries, such as Nextweb's package below, on any release with a new enough glibc.

None of these fixes Python 2.7. Each keeps an application running while it moves to Python 3.

What Nextweb's Python 2.7 package is

python2.7.18-linux-x64, published on 24 October 2026, is Python 2.7.18 as Python released it, built with:

• OpenSSL 1.1.1w, the last public 1.1.1 release, SQLite 3.54.1 and the other libraries it needs linked in, so it needs only glibc 2.31 or later on x86_64;
• pip 20.3.4, the last pip for Python 2 (pip's own warning below says 21.0 drops it), and setuptools 44.1.1;
• bin/python and bin/python2, and never bin/python3, so it never answers for a Python 3 command;
• curses, readline, dbm, gdbm, bsddb, crypt, nis and tkinter left out.

It was installed and checked by Nextweb's verification on Debian 11, 12 and 13, Ubuntu 20.04, 22.04, 24.04 and 26.04, AlmaLinux 9 and 10, Amazon Linux 2023 and Fedora 42 before it was published.

What it is not: it has no fixes of its own. CVE-2021-3177, CVE-2021-23336, CVE-2022-0391 and the rest are in it, its OpenSSL gets no public fixes, and its pip carries a certificate bundle from November 2020.

Install it

The run used Nextweb 1.0.0-beta.1.rc.8 (build 175) on Ubuntu 24.04. At the Nextweb prompt:

nextweb:/> pkg install python2-runtime

Installation order: python2-runtime
Installing 1 package(s)...

Installing python2-runtime...
...
  [python2-runtime] python2.7.18-linux-x64 runtime installed: /home/you/nextweb/nextweb_server/runtime/python2.7.18-linux-x64/bin/python2 (Python 2.7 is past its end of life)
python2.7.18-linux-x64 2.7.18 installed successfully

The runtime is a folder; its programs run from it:

$ cd nextweb_server/runtime/python2.7.18-linux-x64
$ bin/python2 --version
$ bin/pip --version
$ bin/python2 -c 'import ssl, sqlite3; print(ssl.OPENSSL_VERSION); print(sqlite3.sqlite_version)'

Python 2.7.18
pip 20.3.4 from /home/you/nextweb/nextweb_server/runtime/python2.7.18-linux-x64/lib/python2.7/site-packages/pip (python 2.7)
OpenSSL 1.1.1w  11 Sep 2023
3.54.1

pip 20.3.4 still installed from PyPI on the day of the run, with its own warning:

$ bin/pip install --target ./vendor six

DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. ...
Collecting six
  Downloading six-1.17.0-py2.py3-none-any.whl (11 kB)
Installing collected packages: six
Successfully installed six-1.17.0

Plan the move

Python 3.14.9 is current, and on Nextweb pkg install python-runtime installs it; How to run Python 3.14 on Debian 11, Ubuntu 20.04 or RHEL 9 without building it shows it on an older release. Both runtimes can sit side by side, so an application can move a part at a time and be tested against both.

Questions

Is Python 2.7 safe to run in 2026?

No. Bugs found since 2020 are not fixed in 2.7.18, and OpenSSL 1.1.1 gets no public fixes. Run it only where it has to run, and move the application to Python 3.

Does Nextweb's package include security fixes?

No. It is 2.7.18 as Python released it, built with current libraries apart from OpenSSL 1.1.1w. The distribution packages on Debian 11 and Ubuntu 20.04 and 22.04 carry their own patches.

Does it install a python3 command?

No. It ships python and python2 only, so nothing that asks for python3 runs it by mistake.