The vulnerability in CPython 3.9 and earlier arises from allowing an empty list to be passed to SSLContext.set_npn_protocols(), which is not disallowed by CPython but is invalid for OpenSSL's API. This leads to a buffer over-read condition when NPN is enabled, as referenced by CVE-2024-5535 in OpenSSL. The issue is of medium severity (CVSS 6.5) due to network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality and availability impact. No known exploits are reported in the wild.

The impact is a potential buffer over-read in CPython's SSL context when NPN is used with an empty protocol list, which could lead to limited information disclosure or application instability. However, since NPN is not widely used and configuring an empty list is unlikely in practice, the real-world risk is low to medium. There is no indication of privilege escalation or integrity impact.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, avoid configuring an empty list for SSLContext.set_npn_protocols(). Given the low usage of NPN, disabling NPN or avoiding its use can mitigate exposure. Monitor official Python updates for patches addressing this issue.