A vulnerability in Python's ssl module (CVE-2026-19553) allows silent skipping of certificate hostname verification when the server_hostname argument is not supplied to ssl.SSLContext.wrap_bio() and related APIs, despite SSLContext.check_hostname being set to True. This could cause programs to incorrectly assume hostname verification succeeded. The issue is fixed in Python version 3.11.6-44.oe2403sp3. Passing a valid non-empty server_hostname mitigates the vulnerability without requiring a patch.