Security Flaw in Python's SSL Module Affecting Certificate Management
CVE-2026-115557

9.4CRITICAL

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
24 October 2026

What is CVE-2026-115557?

The Python SSL module has implemented a denylist feature that automatically rejects known compromised certificates, thereby enhancing user safety. This mechanism operates independently of any configured certificate revocation settings, ensuring that even without active revocation, users are still protected from potentially harmful certificates.

Affected Version(s)

CPython 0 <= 3.16.0

References

http://www.openwall.com/lists/oss-security/2026/10/20/29
related
https://github.com/python/cpython/pull/160042
patch
https://github.com/python/cpython/issues/160040
issue-tracking

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.