CVE-2026-19553
published 2026-09-30CVE-2026-19553: ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check…
PriorityP342high7.6CVSS 4.0
AVNACLATPPRNUIPVCHVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.40%
33.2th percentile
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
ValueError being raised due to misconfiguration.
If the program passes a server_hostname value that isn't an empty string
or None to any of these APIs then certificate hostname verification
proceeds as expected and the program is not affected by this vulnerability.
Mitigating this vulnerability doesn't require updating Python or applying
the patch. To mitigate, pass a valid non-None and non-empty
server_hostname value to SSLContext.wrap_bio(),
asyncio.create_connection(), or asyncio.loop.start_tls() and
certificate hostname verification will proceed as expected. Upgrading to
the latest version of Python or applying the patch only changes the
behavior from silently skipping hostname verification to raising a
ValueError, similar to SSLContext.wrap_socket(), when server_hostname
isn't supplied.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| debian | python3.11 | — | — |
| debian | python3.13 | — | — |
| debian | python3.14 | — | — |
| debian | python3.9 | — | — |
| openshift-virtualization | ocp-virt-validation-checkup-rhel9 | — | — |
| python | python | — | — |
| python36_3.6 | python36 | — | — |
| python_software_foundation | cpython | < 3.10.22 | 3.10.22 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.17 | 3.11.17 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.15 | 3.12.15 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.16 | 3.13.16 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.8 | 3.14.8 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0rc3 | 3.15.0rc3 |
| rhelai3 | bootc-aws-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-rocm-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-gcp-cuda-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| ubuntu | python3.10 | — | — |
| ubuntu | python3.12 | — | — |
CVSS provenance
nvdv4.07.6HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Python Software Foundation up to 3.15.x SSLObject ssl.SSLContext.wrap_bio server_hostname input validation (EUVD-2026-90078)
vuldb·2026-10-01·CVSS 7.6
CVE-2026-19553 [HIGH] Python Software Foundation up to 3.15.x SSLObject ssl.SSLContext.wrap_bio server_hostname input validation (EUVD-2026-90078)
A vulnerability classified as critical has been found in Python Software Foundation Python up to 3.15.x. The impacted element is the function ssl.SSLContext.wrap_bio of the component SSLObject. This manipulation of the argument server_hostname causes improper input validation.
This vulnerability appears as CVE-2026-19553. The attack may be initiated remotely. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set.
ghsa_unreviewed·2026-09-30
CVE-2026-19553 [HIGH] CWE-297 ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
ValueError being raised due to misconfiguration.
If the program passes a server_hostname value that isn't an empty string
or None to any of these APIs then certificate hostname verification
proceeds as expected and the program is not affected by this vulnerability.
Mitigating this vulnerability doesn't require updating Python or applying
the patch. To mitigate, pass a
Red Hat
python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()
vendor_redhat·2026-09-30·CVSS 7.6
CVE-2026-19553 [HIGH] CWE-295 python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()
python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()
A flaw was found in Python. When establishing secure connections using the SSLContext.wrap_bio() function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rather than triggering an error. A remote man-in-the-middle attacker could exploit this defect to spoof trusted endpoints and intercept or tamper with sensitive encrypted traffic.
Package: python3.12 (Red Hat Enterprise Linux 10) - Affected
Package: python3.14 (Red Hat Enterprise Linux 10) - Affected
Package: python (Red Hat Enterprise Linux 6) - Affected
Package: python (Red Hat Enter
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-19553 asahi-installer: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [epel-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 asahi-installer: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [epel-all]
CVE-2026-19553 asahi-installer: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
Va
Bugzilla
CVE-2026-19553 python3.6: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 python3.6: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
CVE-2026-19553 python3.6: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
ValueE
Bugzilla
CVE-2026-19553 python3.13: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 python3.13: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
CVE-2026-19553 python3.13: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
Value
Bugzilla
CVE-2026-19553 python3.9: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 python3.9: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
CVE-2026-19553 python3.9: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
ValueE
Bugzilla
CVE-2026-19553 python3.15: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 python3.15: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
CVE-2026-19553 python3.15: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
Value
Bugzilla
CVE-2026-19553 python3.12: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 python3.12: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
CVE-2026-19553 python3.12: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
Value
Bugzilla
CVE-2026-19553 python3.10: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 python3.10: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
CVE-2026-19553 python3.10: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
Value
Bugzilla
CVE-2026-19553 python3.13: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [epel-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 python3.13: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [epel-all]
CVE-2026-19553 python3.13: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
ValueEr
Bugzilla
CVE-2026-19553 python3.14: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 python3.14: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
CVE-2026-19553 python3.14: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
Value
Bugzilla
CVE-2026-19553 mingw-python3: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 mingw-python3: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
CVE-2026-19553 mingw-python3: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
Va
Bugzilla
CVE-2026-19553 python3.11: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 python3.11: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
CVE-2026-19553 python3.11: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
Value
Bugzilla
CVE-2026-19553 asahi-installer: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
bugzilla·2026-10-06·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 asahi-installer: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
CVE-2026-19553 asahi-installer: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
Bugzilla
CVE-2026-19553 python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()
bugzilla·2026-09-30·CVSS 7.6
CVE-2026-19553 [HIGH] CVE-2026-19553 python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()
CVE-2026-19553 python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
ValueError being raised due to misconfiguration.
If the program passes a server_hostname value that isn't an empty string
or None to any of these APIs then certificate hostname verification
proceeds as expected and the program is not affected by
https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccfhttps://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1edhttps://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466cedhttps://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062https://github.com/python/cpython/issues/156793https://github.com/python/cpython/pull/158503https://mail.python.org/archives/list/[email protected]/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/http://www.openwall.com/lists/oss-security/2026/09/30/16
2026-09-30
Published