SSL Certificate Identity Check Flaw in Python's ssl Module
CVE-2026-19552

NONE

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
9 November 2026

What is CVE-2026-19552?

A vulnerability exists in the Python ssl module, where the ca_certs parameter passed to the ssl.get_server_certificate() function fails to validate the identity of the server certificate. This loophole could allow an attacker to present a fraudulent certificate, potentially leading to man-in-the-middle attacks and unauthorized data access. It is crucial to review and apply the necessary patches to safeguard applications relying on this functionality.

Affected Version(s)

CPython 0 < 3.16.0

References

https://github.com/python/cpython/pull/161507
patch
https://github.com/python/cpython/issues/161503
issue-tracking
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory

CVSS V4

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

devdanzin (https://github.com/devdanzin)
Bhuvansh (https://github.com/BHUVANSH855)
Bénédikt Tran (https://github.com/picnixz)
Brett Smith (https://github.com/brettcs)
Kirill Podoprigora (https://github.com/Eclips4)
Gregory P. Smith (https://github.com/gpshead)
Seth Larson (https://github.com/sethmlarson)
devdanzin (https://github.com/devdanzin)
.