CVE-2026-115557
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user…
- Risk score
- 71/100
- CVSS
- 9.4 v4.0
- Published
- 24 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. An attacker could exploit this vulnerability to conduct a man-in-the-middle attack.
- Affected
- {'products': ['Python'], 'packages': [], 'versions': ['all versions']}
- Fix
- Check the linked advisory for details on affected versions and a fix.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.4 critical
- Remotely exploitable without logging in
- On your watchlist: python
References
- http://www.openwall.com/lists/oss-security/2026/10/20/29
- https://emudhra.we-have-a-problem.com/
- https://github.com/python/cpython/issues/160040
- https://github.com/python/cpython/pull/160042
- https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/
- http://www.openwall.com/lists/oss-security/2026/10/24/5
- https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d
- https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd
- https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93
- https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6
Original description
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Last activity 24 Oct 2026. Patch Forecast updates every hour.