A security vulnerability in Python's ssl module (CVE-2026-19553) affects the SSLContext.wrap_bio() method where the server_hostname argument was not properly validated. If server_hostname is not supplied, hostname verification is silently skipped despite SSLContext.check_hostname being set to True. This could cause programs to mistakenly believe certificate hostname verification succeeded. Passing a valid non-empty server_hostname prevents the issue. The vulnerability is fixed in Python version 3.11.6-46.oe2403sp4.