CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
- State
- Published
- Severity
- 9.4 Critical
- Published
- Oct 24, 2026
- Updated
- Oct 27, 2026
- Reserved
- Oct 22, 2026
Description
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | PSF |
Weaknesses
- CWE-299 Improper check for certificate revocation
Affected Products
| Product | Versions |
|---|---|
CPythonPython Software Foundation |
|
References
- http://www.openwall.com/lists/oss-security/2026/10/20/29related
- https://github.com/python/cpython/pull/160042patch
- https://github.com/python/cpython/issues/160040issue-tracking
- https://emudhra.we-have-a-problem.com/third-party-advisory
- https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/vendor-advisory
- https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854dpatch
- https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41ddpatch
- https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93patch
- https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6patch
- https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5patch
- https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5bpatch
- https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90patch
- https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8patch
- https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78patch
- https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370patch
- https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625epatch
- https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3patch
- http://www.openwall.com/lists/oss-security/2026/10/24/5
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.