p PatchFirst

CVE-2026-115557

CVE-2026-115557 · Distrust compromised intermediate certificates in ssl module

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

CVSS 9.4 · Critical · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • python

    Versions
    • ≥ 0, < 3.11.18: Affected (python)
    • ≥ 3.12.0, < 3.12.16: Affected (python)
    • ≥ 3.13.0, < 3.13.18: Affected (python)
    • ≥ 3.14.0a1, < 3.16.0: Affected (python)

    Update to 3.11.18; Update to 3.12.16; Update to 3.13.18; Update to 3.16.0

  • python3.11 Debian:12

    Versions
    • 3.11.2-6
    • 3.11.2-6+deb12u1
    • 3.11.2-6+deb12u2
    • 3.11.2-6+deb12u3
    • 3.11.2-6+deb12u4
    • 3.11.2-6+deb12u5
    • 3.11.2-6+deb12u6
    • 3.11.2-6+deb12u7
    • 3.11.2-6+deb12u8
    • 3.11.2-6+deb12u9
    • 3.11.3-1
    • 3.11.3-2
    • 3.11.4-1
    • 3.11.5-1
    • 3.11.5-2
    • 3.11.5-3
    • 3.11.6-1
    • 3.11.6-2
    • 3.11.6-3
    • 3.11.6-3~hurd.2
    • 3.11.7-1
    • 3.11.7-2
    • 3.11.8-1
    • 3.11.8-1.1~exp1
    • 3.11.8-1.1~exp2
    • 3.11.8-2
    • 3.11.8-3
    • 3.11.8-3+hurd.1
    • 3.11.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python3.13 Debian:13

    Versions
    • 3.13.11-1
    • 3.13.12-1
    • 3.13.14-1
    • 3.13.15-1
    • 3.13.5-2
    • 3.13.5-2+deb13u1
    • 3.13.5-2+deb13u2
    • 3.13.5-2+deb13u3
    • 3.13.5-2+deb13u4
    • 3.13.5-2+deb13u5
    • 3.13.6-1
    • 3.13.7-1
    • 3.13.8-1
    • 3.13.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python3.13 Debian:14

    Versions
    • 3.13.11-1
    • 3.13.12-1
    • 3.13.14-1
    • 3.13.15-1
    • 3.13.5-2
    • 3.13.6-1
    • 3.13.7-1
    • 3.13.8-1
    • 3.13.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python3.14 Debian:14

    Versions
    • 3.14.0-1
    • 3.14.0-2
    • 3.14.0-3
    • 3.14.0-4
    • 3.14.0-5
    • 3.14.0~a7-1
    • 3.14.0~b1-1
    • 3.14.0~b2-1
    • 3.14.0~b3-1
    • 3.14.0~b4-1
    • 3.14.0~rc1-1
    • 3.14.0~rc2-1
    • 3.14.0~rc3-1
    • 3.14.2-1
    • 3.14.3-1
    • 3.14.3-2
    • 3.14.3-3
    • 3.14.3-4
    • 3.14.3-5
    • 3.14.4-1
    • 3.14.4-2
    • 3.14.5-1
    • 3.14.5~rc1-1
    • 3.14.6-1
    • 3.14.7-1
    • 3.14.7-2
    • 3.14.7-3
    • 3.14.7-4
    • 3.14.7-5
    • 3.14.8-1
    • 3.14.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python3.15 Debian:14

    Versions
    • 3.15.0-1
    • 3.15.0~a8-1
    • 3.15.0~a8-2
    • 3.15.0~b1-1
    • 3.15.0~b1-2
    • 3.15.0~b1-3
    • 3.15.0~b2-1
    • 3.15.0~b3-1
    • 3.15.0~b4-1
    • 3.15.0~rc1-1
    • 3.15.0~rc2-1
    • 3.15.0~rc2-2
    • 3.15.0~rc2-3
    • 3.15.0~rc3-1
    • 3.15.0~rc3-2
    • 3.15.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →