CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
9.4
CRITICAL
Scored by python.org (not yet scored by NVD)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
9.4
CRITICAL
Scored by CNA (PSF) · v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 4.0 vector
NetworkNo authUser action
Scope change
Confidentiality HIntegrity HAvailability H
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Attack requirements AT | N | None |
| Privileges required PR | N | None |
| User interaction UI | P | Passive |
| Confidentiality (vulnerable system) VC | H | High |
| Integrity (vulnerable system) VI | H | High |
| Availability (vulnerable system) VA | H | High |
| Confidentiality (subsequent systems) SC | H | High |
| Integrity (subsequent systems) SI | H | High |
| Availability (subsequent systems) SA | H | High |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
NVD
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 4.0 | 9.4 CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA / PSF | 4.0 | 9.4 CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | affected: 0 … < 3.16.0 default: unaffected |
Linux distribution status
Red Hat ↗
Not tracked by this distribution.
Debian ↗
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| bookworm | python3.11 | open unimportant | |
| forky | python3.13 | open unimportant | |
| sid | python3.13 | open unimportant | |
| trixie | python3.13 | open unimportant | |
| forky | python3.14 | open unimportant | |
| sid | python3.14 | open unimportant | |
| forky | python3.15 | open unimportant | |
| sid | python3.15 | open unimportant |
Ubuntu ↗
Not tracked by this distribution.
References (18)
- http://www.openwall.com/lists/oss-security/2026/10/20/29 NVD, CNA related
- http://www.openwall.com/lists/oss-security/2026/10/24/5 NVD, ADP CVE
- https://emudhra.we-have-a-problem.com/ NVD, CNA third-party-advisory
- https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d NVD, CNA patch
- https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd NVD, CNA patch
- https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93 NVD, CNA patch
- https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6 NVD, CNA patch
- https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5 NVD, CNA patch
- https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b NVD, CNA patch
- https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90 NVD, CNA patch
- https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8 NVD, CNA patch
- https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78 NVD, CNA patch
- https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370 NVD, CNA patch
- https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e NVD, CNA patch
- https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3 NVD, CNA patch
- https://github.com/python/cpython/issues/160040 NVD, CNA issue-tracking
- https://github.com/python/cpython/pull/160042 NVD, CNA patch
- https://mail.python.org/archives/list/[email protected]/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/ NVD, CNA vendor-advisory