SSL Certificate Verification Bypass in Python's SSL Module
CVE-2026-19553

7.6HIGH

Key Information:

Vendor: Python Software Foundation
Status: Cpython
Vendor: CVE Published:; 30 September 2026

🔔 Create Python Software Foundation Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-19553?

A vulnerability in Python's SSL module arises from the ssl.SSLContext.wrap_bio() not enforcing a valid server_hostname when hostname validation is enabled. This oversight can lead to a situation where certificate verification appears successful, despite being improperly configured. Without a valid server_hostname value, verification is silently bypassed, potentially compromising data security. However, by ensuring that a proper non-None and non-empty server_hostname is provided to the relevant API calls, developers can effectively mitigate this issue without needing to update their Python environment.

Affected Version(s)

CPython 0 < 3.10.22

CPython 3.11.0 < 3.11.17

CPython 3.12.0 < 3.12.15

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

acw3-tls-lab
Created by monkeyyey