Distrust compromised intermediate certificates in ssl module
Summary
| CVE | CVE-2026-115557 |
|---|---|
| State | PUBLISHED |
| Assigner | PSF |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-24 15:17:33 UTC |
| Updated | 2026-10-25 01:16:49 UTC |
| Description | Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration. |
Risk And Classification
Primary CVSS: v4.0 9.4 CRITICAL from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-299 | CWE-299 CWE-299 Improper check for certificate revocation
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 9.4 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/C... |
| 4.0 | CNA | CVSS | 9.4 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
PassiveConfidentiality
HighIntegrity
HighAvailability
HighSub Conf.
HighSub Integrity
HighSub Availability
HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Python Software Foundation | CPython | affected 3.16.0 python | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/python/cpython/issues/160040 | [email protected] | github.com | |
| github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d | [email protected] | github.com | |
| github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6 | [email protected] | github.com | |
| github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e | [email protected] | github.com | |
| emudhra.we-have-a-problem.com | [email protected] | emudhra.we-have-a-problem.com | |
| github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd | [email protected] | github.com | |
| github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370 | [email protected] | github.com | |
| github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78 | [email protected] | github.com | |
| www.openwall.com/lists/oss-security/2026/10/20/29 | [email protected] | www.openwall.com | |
| github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8 | [email protected] | github.com | |
| github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5 | [email protected] | github.com | |
| github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3 | [email protected] | github.com | |
| github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90 | [email protected] | github.com | |
| www.openwall.com/lists/oss-security/2026/10/24/5 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| mail.python.org/archives/list/[email protected]/thread/FNAJMZV6XQY... | [email protected] | mail.python.org | |
| github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b | [email protected] | github.com | |
| github.com/python/cpython/pull/160042 | [email protected] | github.com | |
| github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.