VDB

CVE-2026-115557

CVE-2026-115557 PUBLISHED CVSS 9.4 CRITICAL

Reported by PSF · Published October 24, 2026

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

Risk Scores

CVSS 4.0
9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected Products

VendorProductVersions
Python Software FoundationCPython0, 3.12.0, 3.13.0
alpinepython30, 0
Python Software FoundationCPython3.16.0a1, 3.14.0, 3.15.0
wolfipython-3.130
wolfipython-3.140

Timeline

  • Oct 24, 2026 CVE Published
  • Oct 25, 2026 EPSS Score
  • Oct 29, 2026 EPSS Score
  • Nov 2, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›