{"id":"CVE-2026-115557","summary":"Distrust compromised intermediate certificates in ssl module","details":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.","aliases":["BIT-libpython-2026-115557","BIT-python-2026-115557","BIT-python-min-2026-115557","PSF-2026-46"],"modified":"2026-11-11T13:20:02.836570546Z","published":"2026-10-24T14:15:14.283Z","related":["openSUSE-SU-2026:12348-1","openSUSE-SU-2026:12504-1"],"database_specific":{"cwe_ids":["CWE-299"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115557.json","cna_assigner":"PSF"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/20/29"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/24/5"},{"type":"ADVISORY","url":"https://emudhra.we-have-a-problem.com/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115557.json"},{"type":"ADVISORY","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557"},{"type":"REPORT","url":"https://github.com/python/cpython/issues/160040"},{"type":"FIX","url":"https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d"},{"type":"FIX","url":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd"},{"type":"FIX","url":"https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93"},{"type":"FIX","url":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6"},{"type":"FIX","url":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5"},{"type":"FIX","url":"https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b"},{"type":"FIX","url":"https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90"},{"type":"FIX","url":"https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"},{"type":"FIX","url":"https://github.com/python/cpython/pull/160042"},{"type":"PACKAGE","url":"https://github.com/python/cpython"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"0"},{"fixed":"26badd80b6dc7786cd8fb63c3608a31f04754219"},{"introduced":"0fb18b02c8ad56299d6a2910be0bab8ad601ef24"},{"fixed":"2c2462afc5d978d31f3d073001fc202d269917ff"},{"introduced":"60403a5409ff2c3f3b07dd2ca91a7a3e096839c7"},{"fixed":"0d4bd512fc429e3d4eacdd113c975e161f21644d"},{"introduced":"ebf955df7a89ed0c7968f79faec1de49f61ed7cb"},{"fixed":"b703b2c5e704341d61e367b9b940b77ed11dded0"},{"introduced":"d220409a13b77de7a6c30abe16ea90db01528edc"},{"fixed":"5e58eaad7c58df58dfa8ea549c87996e01dd1077"},{"introduced":"22d79d9840a275ed6ed36cd590dc74edc61765fb"},{"fixed":"22d79d9840a275ed6ed36cd590dc74edc61765fb"},{"fixed":"21a50891ab4be2e9955239e625ae2b40c6b1854d"},{"fixed":"36cd295f32fc9ba19399e01abee91231440a41dd"},{"fixed":"48d9b2712cd52206c7a5882d0fdca4863ed65e93"},{"fixed":"7dd8b4736a1419750b94a388e6d158be15836fe6"},{"fixed":"98f0e4ed349f370dc8a00366da1a9797e11c9ed5"},{"fixed":"a17d9ef549008133eadf20689b1f4787902efe5b"},{"fixed":"af52b41afa4330fb38583db553631baa2f122f90"},{"fixed":"c7fd7edf7e0d122a3973cf676fae21b6aaa650a8"},{"fixed":"e2a9dd97ef9571c710ac0afaa834c8879aebce78"},{"fixed":"e4500d8a437ee5b988a5410cb9b59d177aa01370"},{"fixed":"e4f63e65a93cf44c14274aa987e644b8c003625e"},{"fixed":"e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"3.11.18"}],"source":"AFFECTED_FIELD"},{"strategy":"StandardRange","range":[{"introduced":"3.12.0"},{"fixed":"3.12.16"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"3.13.0"},{"fixed":"3.13.18"}]},{"range":[{"introduced":"3.14.0"},{"fixed":"3.14.10"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"3.15.0"},{"fixed":"3.15.2"}]},{"range":[{"introduced":"3.16.0a1"},{"fixed":"3.16.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"21a50891ab4be2e9955239e625ae2b40c6b1854d"}]},{"range":[{"fixed":"36cd295f32fc9ba19399e01abee91231440a41dd"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"48d9b2712cd52206c7a5882d0fdca4863ed65e93"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"7dd8b4736a1419750b94a388e6d158be15836fe6"}]},{"range":[{"fixed":"98f0e4ed349f370dc8a00366da1a9797e11c9ed5"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"a17d9ef549008133eadf20689b1f4787902efe5b"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"af52b41afa4330fb38583db553631baa2f122f90"}]},{"range":[{"fixed":"c7fd7edf7e0d122a3973cf676fae21b6aaa650a8"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"e2a9dd97ef9571c710ac0afaa834c8879aebce78"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"e4500d8a437ee5b988a5410cb9b59d177aa01370"}]},{"range":[{"fixed":"e4f63e65a93cf44c14274aa987e644b8c003625e"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v3.13.17","v3.14.9","v3.15.1","v3.15.0","v3.11.17","v3.12.15","v3.13.16","v3.14.8","v3.11.16","v3.12.14","v3.13.15","v3.14.7","v3.13.14","v3.14.6","v3.14.5","v3.15.0b1","v3.14.5rc1","v3.13.13","v3.14.4","v3.15.0a8","v3.15.0a7","v3.12.13","v3.11.15","v3.15.0a6","v3.13.12","v3.14.3","v3.15.0a5","v3.15.0a4","v3.15.0a3","v3.14.2","v3.13.11","v3.13.10","v3.14.1","v3.15.0a2","v3.15.0a1","v3.13.8","v3.11.14","v3.12.12","v3.14.0","v3.13.7","v3.13.6","v3.13.5","v3.13.4","v3.11.13","v3.12.11","v3.14.0b1","v3.13.3","v3.11.12","v3.12.10","v3.14.0a7","v3.14.0a6","v3.14.0a5","v3.13.2","v3.12.9","v3.14.0a4","v3.14.0a3","v3.13.1","v3.12.8","v3.11.11","v3.14.0a2","v3.14.0a1","v3.13.0","v3.12.7","v3.11.10","v3.12.6","v3.12.5","v3.12.4","v3.13.0b1","v3.13.0a6","v3.12.3","v3.11.9","v3.13.0a5","v3.13.0a4","v3.12.2","v3.11.8","v3.13.0a3","v3.12.1","v3.11.7","v3.13.0a2","v3.13.0a1","v3.11.6","v3.12.0","v3.11.5","v3.11.4","v3.12.0b1","v3.11.3","v3.12.0a7","v3.12.0a6","v3.11.2","v3.12.0a5","v3.12.0a4","v3.12.0a3","v3.11.1","v3.12.0a2","v3.12.0a1","v3.11.0rc2","v3.11.0rc1","v3.11.0b5","v3.11.0b4","v3.11.0b3","v3.11.0b2","v3.11.0b1","v3.11.0a7","v3.11.0a6","v3.11.0a5","v3.11.0a4","v3.11.0a3","v3.10.0a7","v3.10.0a1","v3.9.0a2","v3.7.0a2","v3.6.0b1","v3.6.0a3","v3.5.0b1","v3.5.0a4","v3.5.0a3","v3.5.0a2","v3.5.0a1","v3.4.0b3","v3.4.0b2","v3.4.0b1","v3.4.0a4","v3.4.0a3","v3.4.0a2","v3.4.0a1","v3.3.0rc3","v3.3.0rc2","v3.3.0rc1","v3.3.0b2","v3.3.0b1","v3.3.0a4","v3.3.0a3","v3.3.0a2","v3.2rc3","v3.2rc2","v3.2rc1","v3.2b2","v3.2b1","v3.2a4","v3.2a3","v3.2a2","v3.2a1","v3.1","v3.1rc2","v3.1rc1","v3.1b1","v3.1a2","v3.1a1","v3.0rc3","v3.0rc2","v3.0rc1","v3.0b3","v3.0b2","v3.0b1","v3.0a5","v3.0a4","v3.0a3","v3.0a2","v3.0a1","v2.4","v2.4c1","v2.4b2","v2.4b1","v2.4a3","v2.4a2","v2.4a1","v2.3c2","v2.3c1","v2.2a3","v2.1","v2.1c2","v2.1c1","v2.1b2","v2.1b1","v2.1a2","v2.1a1","v2.0","v2.0c1","v2.0b2","v2.0b1","v1.6a2","v1.6a1","v1.5.2","v1.5.2c1","v1.5.2b2","v1.5.2b1","v1.5.2a2","v1.5.2a1","v1.5.1","v1.5","v1.5b2","v1.5b1","v1.5a4","v1.5a3","v1.5a2","v1.5a1","v1.4","v1.4b3","v1.4b2","v1.4b1","v1.3","v1.3b1","v1.2","v1.2b4","v1.2b3","v1.2b2","v1.2b1","v1.1.1","v1.1","v1.0.2","v1.0.1","v0.9.9","v0.9.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115557.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"],"threshold":0.9},"id":"CVE-2026-115557-09b7462a","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","target":{"file":"Modules/_ssl.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","target":{"file":"Modules/_ssl.c","function":"newPySSLSocket"},"deprecated":false,"digest":{"length":2977,"function_hash":"191705627437200287854997013070490452970"},"id":"CVE-2026-115557-2dd10dec"},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","target":{"file":"Modules/_ssl.c","function":"newPySSLSocket"},"deprecated":false,"digest":{"length":3043,"function_hash":"56280158761300933419249271862590179075"},"id":"CVE-2026-115557-311c9994","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"],"threshold":0.9},"id":"CVE-2026-115557-3710abf2"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"],"threshold":0.9},"id":"CVE-2026-115557-4e7bf75c"},{"source":"https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","249830481294650080298236528663764769673","134949556096744398870646435413078257035","205883224611726291114141986066901257124","236738915866659534465695940249703127974","210887092294672740715694065927839624289","176133449056693427239898443610206236139","288422798758036370032428440816371929460","130456764179447088121999758037892072961","105542129947736799847561309588421451365","120892600845899487173191715550550967353"],"threshold":0.9},"id":"CVE-2026-115557-5d0aee23","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","target":{"function":"_set_verify_mode","file":"Modules/_ssl.c"},"deprecated":false,"digest":{"function_hash":"290437881438454414008666605443973194969","length":441},"id":"CVE-2026-115557-5ddebfbc","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"},"deprecated":false,"digest":{"function_hash":"151892012625720414648886001279065125950","length":519},"id":"CVE-2026-115557-7ebdde20","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"]},"id":"CVE-2026-115557-a6e8be42","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"102565169441161694672235038587348650397","length":3465},"id":"CVE-2026-115557-b9c1a03f","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","target":{"file":"Modules/_ssl.c","function":"newPySSLSocket"}},{"source":"https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"},"deprecated":false,"digest":{"length":519,"function_hash":"151892012625720414648886001279065125950"},"id":"CVE-2026-115557-bef78288","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"},"deprecated":false,"digest":{"function_hash":"290437881438454414008666605443973194969","length":441},"id":"CVE-2026-115557-c6398b6b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","229422805876342649744950105099714730642","130329821456587203787834809973961521473","138947713681684904628640007576067002568","168398003599931133949957715081662883933","29456615883584131281259238953157377430","242757717082730188500821256786854773831","240375076327967952430039559328208001334","249830481294650080298236528663764769673","134949556096744398870646435413078257035","205883224611726291114141986066901257124","236738915866659534465695940249703127974","210887092294672740715694065927839624289","176133449056693427239898443610206236139","288422798758036370032428440816371929460","130456764179447088121999758037892072961","105542129947736799847561309588421451365","120892600845899487173191715550550967353"],"threshold":0.9},"id":"CVE-2026-115557-e2995511","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90"},{"source":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","target":{"file":"Modules/_ssl.c","function":"newPySSLSocket"},"deprecated":false,"digest":{"function_hash":"121927350968857189667226680689703665796","length":3075},"id":"CVE-2026-115557-e377c519","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":441,"function_hash":"290437881438454414008666605443973194969"},"id":"CVE-2026-115557-f7518325","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","target":{"function":"_set_verify_mode","file":"Modules/_ssl.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"},"deprecated":false,"digest":{"function_hash":"290437881438454414008666605443973194969","length":441},"id":"CVE-2026-115557-fcfbb104"}],"vanir_signatures_modified":"2026-11-11T13:20:02Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}]}