What’s Vulnerable › Vulnerabilities
CVE-2026-115557: Distrust compromised intermediate certificates in ssl module
- Severity: critical (CVSS 9.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-24 · updated 2026-10-27
- Weakness: CWE-299
Description
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Summary
Python's ssl module now rejects known compromised intermediate certificates via a built-in denylist, regardless of SSLContext policy settings, closing a gap when certificate revocation is not configured. Without this fix, connections trusting compromised intermediates could be intercepted, hence the critical 9.4 CVSS score. Affected are Python users on versions prior to the fixes; the issue is not in CISA KEV and EPSS puts 30-day exploitation probability at 0.5%. Upgrade to Python 3.11.18, 3.12.16, 3.13.18, or 3.14.10.
أضاف module ssl في Python قائمة حظر للشهادات الوسيطة المخترقة المعروفة لرفضها تلقائياً بغض النظر عن إعدادات سياسة SSLContext، ما يسد ثغرة عند عدم تفعيل إبطال الشهادات. وبدون هذا الإصلاح قد تُعترض الاتصالات التي تثق بشهادات وسيطة مخترقة، ولذلك جاءت درجة CVSS حرجة 9.4. المتأثرون هم مستخدمو Python بالإصدارات الأقدم من الإصدارات المصلحة؛ ولا ترد الثغرة في CISA KEV وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بـ 0.5%. يُنصح بالترقية إلى Python 3.11.18 أو 3.12.16 أو 3.13.18 أو 3.14.10.
Affected products
- Python: before 3.11.18; from 3.12.0 before 3.12.16; from 3.13.0 before 3.13.18; from 3.14.0 before 3.14.10; from 3.15.0 before 3.15.2; from 3.16.0a1 before 3.16.0 — fixed in 3.11.18, 3.12.16, 3.13.18, 3.14.10, 3.15.2, 3.16.0
How to fix
Upgrade to a fixed version: Python 3.11.18, 3.12.16, 3.13.18, 3.14.10. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2026/10/20/29
- https://emudhra.we-have-a-problem.com/
- https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d
- https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd
- https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93
- https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6
- https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5
- https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b
- https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90
- https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8
- https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78
- https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370
Get alerted when CVE-2026-115557 or the next vulnerability affects your stack