Critical 9.4Published Oct 24, 2026

CVE-2026-115557Distrust compromised intermediate certificates in ssl module

Updated under an hour ago (Oct 28, 2026, 6:50 PM ET)

Does this affect you?

It affects Python Software Foundation CPython. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.53%, higher than 45% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Python Software Foundation CPython

Exploited in the last 30 days

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

CVSS: 9.4 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness (CWE): CWE-299
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.53% (percentile 45)
Assigned by: PSF
NVD analysis: Awaiting Analysis
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 24, 2026

Affected products

Affected products

Python Software Foundation CPython python_software_foundation:cpython (from the name)	before 3.11.18; from 3.12.0 before 3.12.16; from 3.13.0 before 3.13.18; from 3.14.0 before 3.14.10; from 3.15.0 before 3.15.2; from 3.16.0a1 before 3.16.0	CNA record

References

References

http://www.openwall.com/lists/oss-security/2026/10/20/29	related
https://github.com/python/cpython/pull/160042	patch
https://github.com/python/cpython/issues/160040	issue-tracking
https://emudhra.we-have-a-problem.com/	third-party-advisory
https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/	vendor-advisory
https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d	patch
https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd	patch
https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93	patch
https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6	patch
https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5	patch
1–10 of 18

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.