Vulnerability details
CVE-2026-115557
Python Software Foundation CPython
Distrust compromised intermediate certificates in ssl module
CVSS 4.0
9.4Critical
Official description
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (PSF) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Python Software Foundation | CPython | v < 3.11.18 | CVEProject cvelistV5 (CNA) |
| Python Software Foundation | CPython | 3.12.0 ≤ v < 3.12.16 | CVEProject cvelistV5 (CNA) |
| Python Software Foundation | CPython | 3.13.0 ≤ v < 3.13.18 | CVEProject cvelistV5 (CNA) |
| Python Software Foundation | CPython | 3.14.0 ≤ v < 3.14.10 | CVEProject cvelistV5 (CNA) |
| Python Software Foundation | CPython | 3.15.0 ≤ v < 3.15.2 | CVEProject cvelistV5 (CNA) |
| Python Software Foundation | CPython | 3.16.0a1 ≤ v < 3.16.0 | CVEProject cvelistV5 (CNA) |
References and advisories
18- http://www.openwall.com/lists/oss-security/2026/10/20/29 related
- https://github.com/python/cpython/pull/160042 patch
- https://github.com/python/cpython/issues/160040 issue-tracking
- https://emudhra.we-have-a-problem.com/ third-party-advisory
- https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/ vendor-advisory
- https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d patch
- https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd patch
- https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93 patch
- https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6 patch
- https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5 patch
- https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b patch
- https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90 patch
- https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8 patch
- https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78 patch
- https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370 patch
- https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e patch
- https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3 patch
- http://www.openwall.com/lists/oss-security/2026/10/24/5
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-24
- Last updated
- 2026-11-02
- State
- Published
- Assigner (CNA)
- PSF
- Kolun priority
- 25 · Low
Exploit prediction (EPSS)
0.53%
Probability of exploitation in 30 days
45.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-299Improper check for certificate revocation