CVE-2026-115557: CWE-299 Improper check for certificate revocation in Python Software Foundation CPython
Affects Python Software Foundation CPythonSource CVE Database V5
Not known to be exploited · CVSS 9.4 Critical : patch Python Software Foundation CPython as a priority.
Data as of 10/24/2026, 16:08:18 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Python Software FoundationCPython | Affected
| Fixed in– |
GitHub ActionsCPythonpkg:github/CPythonOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in CPython versions after 3.16.0, where a denylist for known compromised certificates is implemented in the ssl module. Users should upgrade to a version later than 3.16.0 to benefit from this mitigation. Since this is not a cloud service, remediation requires updating the affected software. Patch status beyond the provided affected versions is not explicitly stated, so users should consult the official Python Software Foundation advisories for the latest updates.
Description
CVE-2026-115557 is a critical vulnerability in the Python Software Foundation's CPython implementation affecting versions from 0 up to and including 3.16.0. It involves an improper check for certificate revocation (CWE-299) in the ssl module. To mitigate this, Python has introduced a denylist of known compromised certificates that are automatically rejected regardless of SSLContext policy configuration, enhancing user safety even when certificate revocation is not configured.
Impact
The vulnerability allows potentially compromised certificates to be accepted if revocation checks are not properly configured, which could lead to man-in-the-middle attacks or other security breaches involving SSL/TLS connections. The introduction of a denylist mitigates this risk by rejecting known compromised certificates automatically, reducing the likelihood of successful exploitation.
Summary
This vulnerability (CVE-2026-115557) concerns an improper check for certificate revocation in CPython's ssl module, classified under CWE-299. The issue could allow acceptance of compromised certificates if revocation checks are not properly enforced. The Python Software Foundation addressed this by adding a denylist of known compromised certificates to the ssl module, ensuring these certificates are rejected automatically regardless of SSLContext settings. This fix improves security by preventing the use of certificates known to be compromised even if revocation checking is disabled or misconfigured.
Weaknesses
References
- openwall.com/lists/oss-security/2026/10/20/29 (opens in a new tab)
- github.com/python/cpython/pull/160042 (opens in a new tab)
- github.com/python/cpython/issues/160040 (opens in a new tab)
- emudhra.we-have-a-problem.com (opens in a new tab)
- mail.python.org/archives/list/[email protected]/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/ (opens in a new tab)