{"id":"PSF-2026-46","details":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.","aliases":["CVE-2026-115557"],"modified":"2026-10-25T07:06:41.833226849Z","published":"2026-10-24T14:15:14.283Z","database_specific":{"cwe_ids":[]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/20/29"},{"type":"WEB","url":"https://github.com/python/cpython/pull/160042"},{"type":"REPORT","url":"https://github.com/python/cpython/issues/160040"},{"type":"WEB","url":"https://emudhra.we-have-a-problem.com/"},{"type":"ADVISORY","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/"},{"type":"FIX","url":"https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d"},{"type":"FIX","url":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd"},{"type":"FIX","url":"https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93"},{"type":"FIX","url":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6"},{"type":"FIX","url":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5"},{"type":"FIX","url":"https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b"},{"type":"FIX","url":"https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90"},{"type":"FIX","url":"https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e"},{"type":"FIX","url":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"0"},{"fixed":"21a50891ab4be2e9955239e625ae2b40c6b1854d"},{"fixed":"36cd295f32fc9ba19399e01abee91231440a41dd"},{"fixed":"48d9b2712cd52206c7a5882d0fdca4863ed65e93"},{"fixed":"7dd8b4736a1419750b94a388e6d158be15836fe6"},{"fixed":"98f0e4ed349f370dc8a00366da1a9797e11c9ed5"},{"fixed":"a17d9ef549008133eadf20689b1f4787902efe5b"},{"fixed":"af52b41afa4330fb38583db553631baa2f122f90"},{"fixed":"c7fd7edf7e0d122a3973cf676fae21b6aaa650a8"},{"fixed":"e2a9dd97ef9571c710ac0afaa834c8879aebce78"},{"fixed":"e4500d8a437ee5b988a5410cb9b59d177aa01370"},{"fixed":"e4f63e65a93cf44c14274aa987e644b8c003625e"},{"fixed":"e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"}]}],"versions":["v3.13.17","v3.14.9","v3.15.1","v3.16.0a1","v3.15.0","v3.15.0rc3","v3.11.17","v3.12.15","v3.13.16","v3.14.8","v3.15.0rc2","v3.11.16","v3.12.14","v3.13.15","v3.14.7","v3.15.0rc1","v3.15.0b4","v3.15.0b3","v3.13.14","v3.14.6","v3.15.0b2","v3.14.5","v3.15.0b1","v3.14.5rc1","v3.13.13","v3.14.4","v3.15.0a8","v3.15.0a7","v3.12.13","v3.11.15","v3.15.0a6","v3.13.12","v3.14.3","v3.15.0a5","v3.15.0a4","v3.15.0a3","v3.14.2","v3.13.11","v3.13.10","v3.14.1","v3.15.0a2","v3.15.0a1","v3.13.8","v3.11.14","v3.12.12","v3.14.0","v3.14.0rc3","v3.13.7","v3.14.0rc2","v3.13.6","v3.14.0rc1","v3.14.0b4","v3.14.0b3","v3.13.5","v3.13.4","v3.11.13","v3.12.11","v3.14.0b2","v3.14.0b1","v3.13.3","v3.11.12","v3.12.10","v3.14.0a7","v3.14.0a6","v3.14.0a5","v3.13.2","v3.12.9","v3.14.0a4","v3.14.0a3","v3.13.1","v3.12.8","v3.11.11","v3.14.0a2","v3.14.0a1","v3.13.0","v3.13.0rc3","v3.12.7","v3.11.10","v3.13.0rc2","v3.12.6","v3.12.5","v3.13.0rc1","v3.13.0b4","v3.13.0b3","v3.12.4","v3.13.0b2","v3.13.0b1","v3.13.0a6","v3.12.3","v3.11.9","v3.13.0a5","v3.13.0a4","v3.12.2","v3.11.8","v3.13.0a3","v3.12.1","v3.11.7","v3.13.0a2","v3.13.0a1","v3.11.6","v3.12.0","v3.12.0rc3","v3.12.0rc2","v3.11.5","v3.12.0rc1","v3.12.0b4","v3.12.0b3","v3.11.4","v3.12.0b2","v3.12.0b1","v3.11.3","v3.12.0a7","v3.12.0a6","v3.11.2","v3.12.0a5","v3.12.0a4","v3.12.0a3","v3.11.1","v3.12.0a2","v3.12.0a1","v3.11.0rc2","v3.11.0rc1","v3.11.0b5","v3.11.0b4","v3.11.0b3","v3.11.0b2","v3.11.0b1","v3.11.0a7","v3.11.0a6","v3.11.0a5","v3.11.0a4","v3.11.0a3","v3.10.0a7","v3.10.0a1","v3.9.0a2","v3.7.0a2","v3.6.0b1","v3.6.0a3","v3.5.0b1","v3.5.0a4","v3.5.0a3","v3.5.0a2","v3.5.0a1","v3.4.0b3","v3.4.0b2","v3.4.0b1","v3.4.0a4","v3.4.0a3","v3.4.0a2","v3.4.0a1","v3.3.0rc3","v3.3.0rc2","v3.3.0rc1","v3.3.0b2","v3.3.0b1","v3.3.0a4","v3.3.0a3","v3.3.0a2","v3.2rc3","v3.2rc2","v3.2rc1","v3.2b2","v3.2b1","v3.2a4","v3.2a3","v3.2a2","v3.2a1","v3.1","v3.1rc2","v3.1rc1","v3.1b1","v3.1a2","v3.1a1","v3.0rc3","v3.0rc2","v3.0rc1","v3.0b3","v3.0b2","v3.0b1","v3.0a5","v3.0a4","v3.0a3","v3.0a2","v3.0a1","v2.4","v2.4c1","v2.4b2","v2.4b1","v2.4a3","v2.4a2","v2.4a1","v2.3c2","v2.3c1","v2.2a3","v2.1","v2.1c2","v2.1c1","v2.1b2","v2.1b1","v2.1a2","v2.1a1","v2.0","v2.0c1","v2.0b2","v2.0b1","v1.6a2","v1.6a1","v1.5.2","v1.5.2c1","v1.5.2b2","v1.5.2b1","v1.5.2a2","v1.5.2a1","v1.5.1","v1.5","v1.5b2","v1.5b1","v1.5a4","v1.5a3","v1.5a2","v1.5a1","v1.4","v1.4b3","v1.4b2","v1.4b1","v1.3","v1.3b1","v1.2","v1.2b4","v1.2b3","v1.2b2","v1.2b1","v1.1.1","v1.1","v1.0.2","v1.0.1","v0.9.9","v0.9.8"],"database_specific":{"source":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-46.json","vanir_signatures":[{"id":"PSF-2026-46-09b7462a","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"]}},{"target":{"function":"newPySSLSocket","file":"Modules/_ssl.c"},"deprecated":false,"digest":{"function_hash":"191705627437200287854997013070490452970","length":2977},"id":"PSF-2026-46-2dd10dec","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5"},{"target":{"file":"Modules/_ssl.c","function":"newPySSLSocket"},"deprecated":false,"digest":{"function_hash":"56280158761300933419249271862590179075","length":3043},"id":"PSF-2026-46-311c9994","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"],"threshold":0.9},"id":"PSF-2026-46-3710abf2"},{"id":"PSF-2026-46-4e7bf75c","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","249830481294650080298236528663764769673","134949556096744398870646435413078257035","205883224611726291114141986066901257124","236738915866659534465695940249703127974","210887092294672740715694065927839624289","176133449056693427239898443610206236139","288422798758036370032428440816371929460","130456764179447088121999758037892072961","105542129947736799847561309588421451365","120892600845899487173191715550550967353"],"threshold":0.9},"id":"PSF-2026-46-5d0aee23"},{"deprecated":false,"digest":{"function_hash":"290437881438454414008666605443973194969","length":441},"id":"PSF-2026-46-5ddebfbc","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"}},{"id":"PSF-2026-46-7ebdde20","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"},"deprecated":false,"digest":{"function_hash":"151892012625720414648886001279065125950","length":519}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","21884609601975357649917134593042529944","136165768508008028945992981145197065028","330788130771942814246540460120775367056","15949714626956394121619362262004021854","124051474882245648160737536393568773260","242757717082730188500821256786854773831","240375076327967952430039559328208001334","185277528451095632571122012543930156537","248903670722248384815981248722484760574","175989873312767661036254412706751685521","161683403892585145159284253956433083260"],"threshold":0.9},"id":"PSF-2026-46-a6e8be42"},{"id":"PSF-2026-46-b9c1a03f","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","target":{"function":"newPySSLSocket","file":"Modules/_ssl.c"},"deprecated":false,"digest":{"length":3465,"function_hash":"102565169441161694672235038587348650397"}},{"source":"https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"},"deprecated":false,"digest":{"length":519,"function_hash":"151892012625720414648886001279065125950"},"id":"PSF-2026-46-bef78288","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":441,"function_hash":"290437881438454414008666605443973194969"},"id":"PSF-2026-46-c6398b6b","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"}},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["192217216991091263475711989879938316954","238070989960576811264482105902919823341","134038719095220871405284827112287868518","77970071526235605340954041649680607146","229422805876342649744950105099714730642","130329821456587203787834809973961521473","138947713681684904628640007576067002568","168398003599931133949957715081662883933","29456615883584131281259238953157377430","242757717082730188500821256786854773831","240375076327967952430039559328208001334","249830481294650080298236528663764769673","134949556096744398870646435413078257035","205883224611726291114141986066901257124","236738915866659534465695940249703127974","210887092294672740715694065927839624289","176133449056693427239898443610206236139","288422798758036370032428440816371929460","130456764179447088121999758037892072961","105542129947736799847561309588421451365","120892600845899487173191715550550967353"],"threshold":0.9},"id":"PSF-2026-46-e2995511","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","target":{"file":"Modules/_ssl.c","function":"newPySSLSocket"},"deprecated":false,"digest":{"function_hash":"121927350968857189667226680689703665796","length":3075},"id":"PSF-2026-46-e377c519","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","target":{"function":"_set_verify_mode","file":"Modules/_ssl.c"},"deprecated":false,"digest":{"length":441,"function_hash":"290437881438454414008666605443973194969"},"id":"PSF-2026-46-f7518325"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","target":{"file":"Modules/_ssl.c","function":"_set_verify_mode"},"deprecated":false,"digest":{"function_hash":"290437881438454414008666605443973194969","length":441},"id":"PSF-2026-46-fcfbb104"}],"vanir_signatures_modified":"2026-10-25T07:06:41Z"}}],"schema_version":"1.9.2"}