CVE-2026-115557
published 2026-10-24CVE-2026-115557: Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known…
PriorityP346critical9.4CVSS 4.0
AVNACLATNPRNUIPVCHVIHVAHSCHSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.53%
44.8th percentile
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| python_software_foundation | cpython | < 3.11.18 | 3.11.18 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.16 | 3.12.16 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.18 | 3.13.18 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.10 | 3.14.10 |
| python_software_foundation | cpython | >= 3.15.0 < 3.15.2 | 3.15.2 |
| python_software_foundation | cpython | >= 3.16.0a1 < 3.16.0 | 3.16.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
PSF Python ssl certificate validation (EUVD-2026-109299)
vuldb·2026-10-24·CVSS 9.4
CVE-2026-115557 [CRITICAL] PSF Python ssl certificate validation (EUVD-2026-109299)
A vulnerability classified as problematic was found in PSF Python. This vulnerability affects unknown code of the component ssl. The manipulation results in improper certificate validation.
This vulnerability is reported as CVE-2026-115557. The attack can be launched remotely. No exploit exists.
GHSA
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured.
ghsa_unreviewed·2026-10-24
CVE-2026-115557 [CRITICAL] CWE-299 Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured.
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2026/10/20/29https://emudhra.we-have-a-problem.com/https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854dhttps://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41ddhttps://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5bhttps://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625ehttps://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3https://github.com/python/cpython/issues/160040https://github.com/python/cpython/pull/160042https://mail.python.org/archives/list/[email protected]/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/http://www.openwall.com/lists/oss-security/2026/10/24/5
2026-10-24
Published