The vulnerability arises because ssl.SSLContext.wrap_bio() and related APIs did not enforce that the server_hostname parameter be non-None when SSLContext.check_hostname was set to True. Without a valid server_hostname, hostname verification was silently bypassed, allowing programs to mistakenly believe hostname verification succeeded. This affects CPython versions prior to 3.16.0. The vulnerability is classified as CWE-297 (Improper Validation of Certificate with Host Mismatch). Mitigation does not require patching; passing a valid server_hostname ensures hostname verification proceeds correctly. The patch changes the behavior to raise an error if server_hostname is missing, preventing silent skips.

Programs using ssl.SSLContext.wrap_bio() or related APIs with SSLContext.check_hostname enabled but without providing a valid server_hostname may silently skip hostname verification. This can lead to trust in TLS connections without proper hostname validation, increasing the risk of man-in-the-middle attacks. However, if a valid server_hostname is provided, the vulnerability does not affect the program. There are no known exploits in the wild. The CVSS 4.0 score is 7.6 (high severity), reflecting network attack vector, low attack complexity, partial attack and user interaction, and high impact on confidentiality and integrity.

To mitigate this vulnerability, ensure that a valid, non-None, and non-empty server_hostname argument is passed to ssl.SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() when SSLContext.check_hostname is enabled. This causes hostname verification to proceed as intended. Upgrading to Python 3.16.0 or later or applying the patch changes the behavior to raise a ValueError if server_hostname is omitted, preventing silent verification skips. No immediate patching is required if the mitigation is applied correctly.