CVE Feed

    Dashboard / CVE / CVE-2026-115557

    CVE-2026-115557

    Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

    Published:Oct 24, 2026
    Last Modified:Oct 25, 2026
    EPS:Oct 24, 2026
    EPSS Score:
    CVSS Score:9.4

    Affected Products

    Vendor
    Python
    Product
    Cpython
    Vendor
    Python Software Foundation
    Product
    Cpython

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-114583 (CVSS 6.9) — tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-li…
    CVE-2026-19553 (CVSS 7.6) — ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_h…
    CVE-2026-19445 (CVSS 9.2) — A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callba…
    CVE-2026-12345 (CVSS 5.9) — The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the t…
    CVE-2026-82049 (CVSS 8.4) — In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted ar…
    CVE-2026-87910 (CVSS 5.7) — When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from…
    CVE-2026-15310 (CVSS 2.1) — When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacke…
    CVE-2026-19672 (CVSS 6.3) — The tarfile module's tar and data extraction filters created directories outside the destination for members…
    CVE-2026-15806 (CVSS 6) — The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRe…
    CVE-2026-17084 (CVSS 6) — The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unico…

    References

    http://www.openwall.com/lists/oss-security/2026/10/20/29
    https://emudhra.we-have-a-problem.com/
    https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d
    https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd
    https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93
    https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6
    https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5
    https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b
    https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90
    https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8
    https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78
    https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370
    https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e
    https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3
    https://github.com/python/cpython/issues/160040
    https://github.com/python/cpython/pull/160042
    https://mail.python.org/archives/list/[email protected]/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/
    http://www.openwall.com/lists/oss-security/2026/10/24/5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High