CVE-2026-115557

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115557", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "state": "PUBLISHED", "assignerShortName": "PSF", "dateReserved": "2026-10-22T21:32:20.396Z", "datePublished": "2026-10-24T14:15:14.283Z", "dateUpdated": "2026-11-10T20:09:36.413Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["ssl"], "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"lessThan": "3.11.18", "status": "affected", "version": "0", "versionType": "python"}, {"lessThan": "3.12.16", "status": "affected", "version": "3.12.0", "versionType": "python"}, {"lessThan": "3.13.18", "status": "affected", "version": "3.13.0", "versionType": "python"}, {"lessThan": "3.14.10", "status": "affected", "version": "3.14.0", "versionType": "python"}, {"lessThan": "3.15.2", "status": "affected", "version": "3.15.0", "versionType": "python"}, {"lessThan": "3.16.0", "status": "affected", "version": "3.16.0a1", "versionType": "python"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "Christian Heimes (https://github.com/tiran)"}, {"lang": "en", "type": "remediation reviewer", "value": "Gregory P. Smith (https://github.com/gpshead)"}, {"lang": "en", "type": "remediation reviewer", "value": "T. Wouters (https://github.com/Yhg1s)"}, {"lang": "en", "type": "remediation reviewer", "value": "Emma Smith (https://github.com/emmatyping)"}, {"lang": "en", "type": "remediation reviewer", "value": "Seth Larson (https://github.com/sethmlarson)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}], "value": "Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-299", "description": "CWE-299 Improper check for certificate revocation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-11-10T20:09:36.413Z"}, "references": [{"tags": ["related"], "url": "http://www.openwall.com/lists/oss-security/2026/10/20/29"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/pull/160042"}, {"tags": ["issue-tracking"], "url": "https://github.com/python/cpython/issues/160040"}, {"tags": ["third-party-advisory"], "url": "https://emudhra.we-have-a-problem.com/"}, {"tags": ["vendor-advisory"], "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"}], "source": {"discovery": "UNKNOWN"}, "title": "Distrust compromised intermediate certificates in ssl module", "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/24/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-24T18:07:53.662Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T14:11:02.533687Z", "id": "CVE-2026-115557", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T14:11:17.949Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/24/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-24T18:07:53.662Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115557", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-02T14:11:02.533687Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T14:11:12.127Z"}}], "cna": {"title": "Distrust compromised intermediate certificates in ssl module", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "remediation developer", "value": "Christian Heimes (https://github.com/tiran)"}, {"lang": "en", "type": "remediation reviewer", "value": "Gregory P. Smith (https://github.com/gpshead)"}, {"lang": "en", "type": "remediation reviewer", "value": "T. Wouters (https://github.com/Yhg1s)"}, {"lang": "en", "type": "remediation reviewer", "value": "Emma Smith (https://github.com/emmatyping)"}, {"lang": "en", "type": "remediation reviewer", "value": "Seth Larson (https://github.com/sethmlarson)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "modules": ["ssl"], "product": "CPython", "versions": [{"status": "affected", "version": "0", "lessThan": "3.11.18", "versionType": "python"}, {"status": "affected", "version": "3.12.0", "lessThan": "3.12.16", "versionType": "python"}, {"status": "affected", "version": "3.13.0", "lessThan": "3.13.18", "versionType": "python"}, {"status": "affected", "version": "3.14.0", "lessThan": "3.14.10", "versionType": "python"}, {"status": "affected", "version": "3.15.0", "lessThan": "3.15.2", "versionType": "python"}, {"status": "affected", "version": "3.16.0a1", "lessThan": "3.16.0", "versionType": "python"}], "defaultStatus": "unaffected"}], "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/20/29", "tags": ["related"]}, {"url": "https://github.com/python/cpython/pull/160042", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/issues/160040", "tags": ["issue-tracking"]}, {"url": "https://emudhra.we-have-a-problem.com/", "tags": ["third-party-advisory"]}, {"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.", "supportingMedia": [{"type": "text/html", "value": "Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-299", "description": "CWE-299 Improper check for certificate revocation"}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-11-10T20:09:36.413Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115557", "state": "PUBLISHED", "dateUpdated": "2026-11-10T20:09:36.413Z", "dateReserved": "2026-10-22T21:32:20.396Z", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "datePublished": "2026-10-24T14:15:14.283Z", "assignerShortName": "PSF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["ssl"], "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"lessThan": "3.11.18", "status": "affected", "version": "0", "versionType": "python"}, {"lessThan": "3.12.16", "status": "affected", "version": "3.12.0", "versionType": "python"}, {"lessThan": "3.13.18", "status": "affected", "version": "3.13.0", "versionType": "python"}, {"lessThan": "3.14.10", "status": "affected", "version": "3.14.0", "versionType": "python"}, {"lessThan": "3.15.2", "status": "affected", "version": "3.15.0", "versionType": "python"}, {"lessThan": "3.16.0", "status": "affected", "version": "3.16.0a1", "versionType": "python"}]}], "source": "cna@python.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}], "id": "CVE-2026-115557", "lastModified": "2026-11-02T15:17:15.000", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@python.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115557", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T14:11:02.533687Z", "version": "2.0.3"}}]}, "published": "2026-10-24T15:17:33.600", "references": [{"source": "cna@python.org", "url": "http://www.openwall.com/lists/oss-security/2026/10/20/29"}, {"source": "cna@python.org", "url": "https://emudhra.we-have-a-problem.com/"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/issues/160040"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/pull/160042"}, {"source": "cna@python.org", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/24/5"}], "sourceIdentifier": "cna@python.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-299"}], "source": "cna@python.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.16.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CPython", "source": "cna", "vendor": "Python Software Foundation"}, "product": "cpython", "vendor": "python"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.16.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CPython", "source": "cna", "vendor": "Python Software Foundation"}, "product": "cpython", "vendor": "python_software_foundation"}], "created": "2026-10-24T15:45:06.851833+00:00", "updated": "2026-10-24T16:00:18.135302+00:00", "vendors": ["python", "python$PRODUCT$cpython", "python_software_foundation", "python_software_foundation$PRODUCT$cpython"]}