Vulnerability Description
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2026/10/20/29
- https://emudhra.we-have-a-problem.com/
- https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854
- https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41d
- https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e9
- https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe
- https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed
- https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5
- https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f9
- https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a
- https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce7
- https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa0137
- https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625
- https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d
- https://github.com/python/cpython/issues/160040
FAQ
What is CVE-2026-115557?
CVE-2026-115557 is a documented vulnerability. Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatical...
How severe is CVE-2026-115557?
CVSS scoring is not yet available for CVE-2026-115557. Check NVD for updates.
Is there a patch for CVE-2026-115557?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.