CVE-2026-115557
CVE-2026-115557 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.4. The underlying weakness is classified as CWE-299.
Key facts
- Severity: Critical (CVSS 4.0 base score 9.4)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-299
- Published:
- Last modified:
Description
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Frequently asked questions
- What is CVE-2026-115557?
- Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
- How severe is CVE-2026-115557?
- CVE-2026-115557 has a CVSS 4.0 base score of 9.4, rated critical severity.
- Is CVE-2026-115557 being actively exploited?
- It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.
- How do I fix CVE-2026-115557?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2026-115557 published?
- CVE-2026-115557 was published on 2026-10-24.
References
- http://www.openwall.com/lists/oss-security/2026/10/20/29
- https://emudhra.we-have-a-problem.com/
- https://github.com/python/cpython/issues/160040
- https://github.com/python/cpython/pull/160042
- https://mail.python.org/archives/list/[email protected]/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/
Other CWE-299 vulnerabilities
- CVE-2026-9636 — High (CVSS 8.2): A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP…
- CVE-2025-11955 — High (CVSS 8.2): Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2…
- CVE-2026-61699 — High (CVSS 8.1): nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only…
- CVE-2025-3085 — High (CVSS 8.1): A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails…
- CVE-2026-115570 — High (CVSS 7.4): Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to…
- CVE-2026-56821 — High (CVSS 7.4): Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final,…