by Kastro
Paper/Archive/CVE-2026-115557

CVE-2026-115557

Python Software Foundation CPython — Distrust compromised intermediate certificates in ssl module

EPSS 0.5%CVSS 9.4
critical.is priorityof 100
37
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 45.0.450 × 209.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

Affected

ProductAffectedFixed inSource
CPython< 3.11.183.11.18CNA
CPython3.12.0 – < 3.12.163.12.16CNA
CPython3.13.0 – < 3.13.183.13.18CNA
CPython3.14.0 – < 3.14.103.14.10CNA
CPython3.15.0 – < 3.15.23.15.2CNA
CPython3.16.0a1 – < 3.16.03.16.0CNA

Scores by source

PSF (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

refopenwall.com/lists/oss-security/2026/10/20/29patchgithub.com/python/cpython/pull/160042refgithub.com/python/cpython/issues/160040writeupemudhra.we-have-a-problem.comadvisorymail.python.org/archives/list/[email protected]/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4patchgithub.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854dpatchgithub.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41ddpatchgithub.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93patchgithub.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6patchgithub.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5patchgithub.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5bpatchgithub.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90patchgithub.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8patchgithub.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78patchgithub.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370patchgithub.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625epatchgithub.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3refopenwall.com/lists/oss-security/2026/10/24/5