Vulnerability · Published Nov 6, 2026 · Assigned by PSF
CVE-2026-119170Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10
High 8.2
In plain English
A high-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far.
Severity (CVSS 4.0)8.2High
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 3.14.10 – before 3.14.11 |
Weakness: CWE-693 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N