Critical severity · published Oct 24, 2026
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
New
9.4
CVSS
0.5%
EPSS
No
On KEV
Description
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.11.18; 3.12.0 before 3.12.16; 3.13.0 before 3.13.18; 3.14.0 before 3.14.10; 3.15.0 before 3.15.2; 3.16.0a1 before 3.16.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115557
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115557
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/10/20/29
emudhra.we-have-a-problem.com
https://emudhra.we-have-a-problem.com/
github.com
https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d
github.com
https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd
github.com
https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93
github.com
https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6
More from CPython
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.4
CVE-2026-82049
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
8.2
CVE-2026-11972
tarfile opened in streaming mode mishandles EOF
8.2
CVE-2026-9669
bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow