{"id":"CVE-2026-115557","summary":"Distrust compromised intermediate certificates in ssl module","details":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.","aliases":["PSF-2026-46"],"modified":"2026-10-25T13:19:18.597091189Z","published":"2026-10-24T14:15:14.283Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115557.json","cna_assigner":"PSF","cwe_ids":["CWE-299"]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/20/29"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/24/5"},{"type":"ADVISORY","url":"https://emudhra.we-have-a-problem.com/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115557.json"},{"type":"PACKAGE","url":"https://github.com/python/cpython"},{"type":"FIX","url":"https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d"},{"type":"FIX","url":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd"},{"type":"FIX","url":"https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93"},{"type":"FIX","url":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6"},{"type":"FIX","url":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5"},{"type":"FIX","url":"https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b"},{"type":"FIX","url":"https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90"},{"type":"FIX","url":"https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"},{"type":"REPORT","url":"https://github.com/python/cpython/issues/160040"},{"type":"FIX","url":"https://github.com/python/cpython/pull/160042"},{"type":"ADVISORY","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"0"},{"fixed":"22d79d9840a275ed6ed36cd590dc74edc61765fb"},{"fixed":"21a50891ab4be2e9955239e625ae2b40c6b1854d"},{"fixed":"36cd295f32fc9ba19399e01abee91231440a41dd"},{"fixed":"48d9b2712cd52206c7a5882d0fdca4863ed65e93"},{"fixed":"7dd8b4736a1419750b94a388e6d158be15836fe6"},{"fixed":"98f0e4ed349f370dc8a00366da1a9797e11c9ed5"},{"fixed":"a17d9ef549008133eadf20689b1f4787902efe5b"},{"fixed":"af52b41afa4330fb38583db553631baa2f122f90"},{"fixed":"c7fd7edf7e0d122a3973cf676fae21b6aaa650a8"},{"fixed":"e2a9dd97ef9571c710ac0afaa834c8879aebce78"},{"fixed":"e4500d8a437ee5b988a5410cb9b59d177aa01370"},{"fixed":"e4f63e65a93cf44c14274aa987e644b8c003625e"},{"fixed":"e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"3.16.0"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"21a50891ab4be2e9955239e625ae2b40c6b1854d"}]},{"range":[{"fixed":"36cd295f32fc9ba19399e01abee91231440a41dd"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"48d9b2712cd52206c7a5882d0fdca4863ed65e93"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"7dd8b4736a1419750b94a388e6d158be15836fe6"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"98f0e4ed349f370dc8a00366da1a9797e11c9ed5"}]},{"range":[{"fixed":"a17d9ef549008133eadf20689b1f4787902efe5b"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"af52b41afa4330fb38583db553631baa2f122f90"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"c7fd7edf7e0d122a3973cf676fae21b6aaa650a8"}]},{"range":[{"fixed":"e2a9dd97ef9571c710ac0afaa834c8879aebce78"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"e4500d8a437ee5b988a5410cb9b59d177aa01370"}]},{"range":[{"fixed":"e4f63e65a93cf44c14274aa987e644b8c003625e"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v3.13.17","v3.14.9","v3.15.1","v3.15.0","v3.15.0rc3","v3.11.17","v3.12.15","v3.13.16","v3.14.8","v3.15.0rc2","v3.11.16","v3.12.14","v3.13.15","v3.14.7","v3.15.0rc1","v3.15.0b4","v3.15.0b3","v3.13.14","v3.14.6","v3.15.0b2","v3.14.5","v3.15.0b1","v3.14.5rc1","v3.13.13","v3.14.4","v3.15.0a8","v3.15.0a7","v3.12.13","v3.11.15","v3.15.0a6","v3.13.12","v3.14.3","v3.15.0a5","v3.15.0a4","v3.15.0a3","v3.14.2","v3.13.11","v3.13.10","v3.14.1","v3.15.0a2","v3.15.0a1","v3.13.8","v3.11.14","v3.12.12","v3.14.0","v3.14.0rc3","v3.13.7","v3.14.0rc2","v3.13.6","v3.14.0rc1","v3.14.0b4","v3.14.0b3","v3.13.5","v3.13.4","v3.11.13","v3.12.11","v3.14.0b2","v3.14.0b1","v3.13.3","v3.11.12","v3.12.10","v3.14.0a7","v3.14.0a6","v3.14.0a5","v3.13.2","v3.12.9","v3.14.0a4","v3.14.0a3","v3.13.1","v3.12.8","v3.11.11","v3.14.0a2","v3.14.0a1","v3.13.0","v3.13.0rc3","v3.12.7","v3.11.10","v3.13.0rc2","v3.12.6","v3.12.5","v3.13.0rc1","v3.13.0b4","v3.13.0b3","v3.12.4","v3.13.0b2","v3.13.0b1","v3.13.0a6","v3.12.3","v3.11.9","v3.13.0a5","v3.13.0a4","v3.12.2","v3.11.8","v3.13.0a3","v3.12.1","v3.11.7","v3.13.0a2","v3.13.0a1","v3.11.6","v3.12.0","v3.12.0rc3","v3.12.0rc2","v3.11.5","v3.12.0rc1","v3.12.0b4","v3.12.0b3","v3.11.4","v3.12.0b2","v3.12.0b1","v3.11.3","v3.12.0a7","v3.12.0a6","v3.11.2","v3.12.0a5","v3.12.0a4","v3.12.0a3","v3.11.1","v3.12.0a2","v3.12.0a1","v3.11.0rc2","v3.11.0rc1","v3.11.0b5","v3.11.0b4","v3.11.0b3","v3.11.0b2","v3.11.0b1","v3.11.0a7","v3.11.0a6","v3.11.0a5","v3.11.0a4","v3.11.0a3","v3.10.0a7","v3.10.0a1","v3.9.0a2","v3.7.0a2","v3.6.0b1","v3.6.0a3","v3.5.0b1","v3.5.0a4","v3.5.0a3","v3.5.0a2","v3.5.0a1","v3.4.0b3","v3.4.0b2","v3.4.0b1","v3.4.0a4","v3.4.0a3","v3.4.0a2","v3.4.0a1","v3.3.0rc3","v3.3.0rc2","v3.3.0rc1","v3.3.0b2","v3.3.0b1","v3.3.0a4","v3.3.0a3","v3.3.0a2","v3.2rc3","v3.2rc2","v3.2rc1","v3.2b2","v3.2b1","v3.2a4","v3.2a3","v3.2a2","v3.2a1","v3.1","v3.1rc2","v3.1rc1","v3.1b1","v3.1a2","v3.1a1","v3.0rc3","v3.0rc2","v3.0rc1","v3.0b3","v3.0b2","v3.0b1","v3.0a5","v3.0a4","v3.0a3","v3.0a2","v3.0a1","v2.4","v2.4c1","v2.4b2","v2.4b1","v2.4a3","v2.4a2","v2.4a1","v2.3c2","v2.3c1","v2.2a3","v2.1","v2.1c2","v2.1c1","v2.1b2","v2.1b1","v2.1a2","v2.1a1","v2.0","v2.0c1","v2.0b2","v2.0b1","v1.6a2","v1.6a1","v1.5.2","v1.5.2c1","v1.5.2b2","v1.5.2b1","v1.5.2a2","v1.5.2a1","v1.5.1","v1.5","v1.5b2","v1.5b1","v1.5a4","v1.5a3","v1.5a2","v1.5a1","v1.4","v1.4b3","v1.4b2","v1.4b1","v1.3","v1.3b1","v1.2","v1.2b4","v1.2b3","v1.2b2","v1.2b1","v1.1.1","v1.1","v1.0.2","v1.0.1","v0.9.9","v0.9.8"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-115557.json","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"],"threshold":0.9},"id":"CVE-2026-115557-09b7462a"},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","target":{"function":"newPySSLSocket","file":"Modules/_ssl.c"},"deprecated":false,"digest":{"length":2977,"function_hash":"191705627437200287854997013070490452970"},"id":"CVE-2026-115557-2dd10dec","signature_type":"Function"},{"id":"CVE-2026-115557-311c9994","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","target":{"function":"newPySSLSocket","file":"Modules/_ssl.c"},"deprecated":false,"digest":{"length":3043,"function_hash":"56280158761300933419249271862590179075"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"],"threshold":0.9},"id":"CVE-2026-115557-3710abf2"},{"id":"CVE-2026-115557-4e7bf75c","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"]}},{"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","249830481294650080298236528663764769673","134949556096744398870646435413078257035","205883224611726291114141986066901257124","236738915866659534465695940249703127974","210887092294672740715694065927839624289","176133449056693427239898443610206236139","288422798758036370032428440816371929460","130456764179447088121999758037892072961","105542129947736799847561309588421451365","120892600845899487173191715550550967353"],"threshold":0.9},"id":"CVE-2026-115557-5d0aee23","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","target":{"file":"Modules/_ssl.c"},"deprecated":false},{"source":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"},"deprecated":false,"digest":{"function_hash":"290437881438454414008666605443973194969","length":441},"id":"CVE-2026-115557-5ddebfbc","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-115557-7ebdde20","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"},"deprecated":false,"digest":{"length":519,"function_hash":"151892012625720414648886001279065125950"}},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"]},"id":"CVE-2026-115557-a6e8be42","signature_type":"Line"},{"id":"CVE-2026-115557-b9c1a03f","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","target":{"file":"Modules/_ssl.c","function":"newPySSLSocket"},"deprecated":false,"digest":{"function_hash":"102565169441161694672235038587348650397","length":3465}},{"source":"https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"},"deprecated":false,"digest":{"function_hash":"151892012625720414648886001279065125950","length":519},"id":"CVE-2026-115557-bef78288","signature_type":"Function","signature_version":"v1"},{"digest":{"length":441,"function_hash":"290437881438454414008666605443973194969"},"id":"CVE-2026-115557-c6398b6b","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","target":{"function":"_set_verify_mode","file":"Modules/_ssl.c"},"deprecated":false},{"id":"CVE-2026-115557-e2995511","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","229422805876342649744950105099714730642","130329821456587203787834809973961521473","138947713681684904628640007576067002568","168398003599931133949957715081662883933","29456615883584131281259238953157377430","242757717082730188500821256786854773831","240375076327967952430039559328208001334","249830481294650080298236528663764769673","134949556096744398870646435413078257035","205883224611726291114141986066901257124","236738915866659534465695940249703127974","210887092294672740715694065927839624289","176133449056693427239898443610206236139","288422798758036370032428440816371929460","130456764179447088121999758037892072961","105542129947736799847561309588421451365","120892600845899487173191715550550967353"]}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","target":{"file":"Modules/_ssl.c","function":"newPySSLSocket"},"deprecated":false,"digest":{"function_hash":"121927350968857189667226680689703665796","length":3075},"id":"CVE-2026-115557-e377c519"},{"deprecated":false,"digest":{"function_hash":"290437881438454414008666605443973194969","length":441},"id":"CVE-2026-115557-f7518325","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"}},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"},"deprecated":false,"digest":{"function_hash":"290437881438454414008666605443973194969","length":441},"id":"CVE-2026-115557-fcfbb104","signature_type":"Function"}],"vanir_signatures_modified":"2026-10-25T13:19:18Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}]}