Vulnerability · Published Oct 24, 2026 · Assigned by PSF
CVE-2026-115557Distrust compromised intermediate certificates in ssl module
Critical 9.4
In plain English
A critical-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)0.5%top 54.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | python3 | 3.12.16-r0 | ALPINE-CVE-2026-115557 |
| Alpine:v3.22 | python3 | 3.12.16-r0 | ALPINE-CVE-2026-115557 |
| Alpine:v3.23 | python3 | 3.12.16-r0 | ALPINE-CVE-2026-115557 |
| Alpine:v3.24 | python3 | 3.14.10-r0 | ALPINE-CVE-2026-115557 |
| Debian:12 | python3.11 | no fix listed | DEBIAN-CVE-2026-115557 |
| Debian:13 | python3.13 | no fix listed | DEBIAN-CVE-2026-115557 |
| Debian:14 | python3.14 | 3.14.10-1 | DEBIAN-CVE-2026-115557 |
| Debian:14 | python3.15 | 3.15.2-1 | DEBIAN-CVE-2026-115557 |
| Ubuntu:22.04:LTS | python3.10 | no fix listed | UBUNTU-CVE-2026-115557 |
| Ubuntu:24.04:LTS | python3.12 | no fix listed | UBUNTU-CVE-2026-115557 |
| Ubuntu:26.04:LTS | python3.14 | no fix listed | UBUNTU-CVE-2026-115557 |
| Ubuntu:26.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-115557 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.11.183.12.0 – before 3.12.163.13.0 – before 3.13.183.14.0 – before 3.14.103.15.0 – before 3.15.23.16.0a1 – before 3.16.0 |
Weakness: CWE-299 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- http://www.openwall.com/lists/oss-security/2026/10/20/29 related
- https://github.com/python/cpython/pull/160042 patch
- https://github.com/python/cpython/issues/160040 issue-tracking
- https://emudhra.we-have-a-problem.com/ third-party-advisory
- https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/ vendor-advisory
- https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d patch
- https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd patch
- https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93 patch
- https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6 patch
- https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5 patch
- https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b patch
- https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90 patch
- https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8 patch
- https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78 patch
- https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370 patch
- https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e patch
- https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3 patch
- http://www.openwall.com/lists/oss-security/2026/10/24/5