FIPS Algorithm Regression in Python's Hashlib Module
CVE-2026-119170

8.2HIGH

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
6 November 2026

What is CVE-2026-119170?

A regression introduced in Python 3.14.10 impacts the enforcement of FIPS algorithms in the hashlib module. This flaw specifically affects users operating OpenSSL in FIPS mode, potentially leading to inadequate cryptographic compliance for sensitive applications. It is crucial for developers and organizations relying on secure cryptographic practices to be aware of this issue and consider applying the necessary patches to maintain security integrity.

Affected Version(s)

CPython 3.14.10 < 3.14.11

References

https://github.com/python/cpython/issues/160923
issue-tracking
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory
https://github.com/python/cpython/pull/160984
patch

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anton Rundberg (https://github.com/anton-rundberg)
Seth Larson (https://github.com/sethmlarson)
Bénédikt Tran (https://github.com/picnixz)
.