CVE-2026-115557 Distrust compromised intermediate certificates in ssl module
CriticalCVSS 9.4
EPSS 0.53%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| azure linux python3(Azure Linux:3.0) | < 3.12.15-3 | 3.12.15-3 |
| redhat/python3.12(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/python3.14(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/python(Red Hat:rhel_els:6) | All versions | No fix listed |
| redhat/python(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/python3(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/python3(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/python3.12(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/python3.12(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/python3.14(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/python3.9(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/rhelai3/bootc-aws-cuda-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-azure-cuda-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-azure-rocm-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-cuda-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-gaudi-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-gcp-cuda-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-rocm-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/python3.10(Red Hat:hummingbird:1) | All versions | No fix listed |
| redhat/python3.11(Red Hat:hummingbird:1) | All versions | No fix listed |
| redhat/python3.12(Red Hat:hummingbird:1) | All versions | No fix listed |
| redhat/python3.13(Red Hat:hummingbird:1) | All versions | No fix listed |
| redhat/python3.14(Red Hat:hummingbird:1) | All versions | No fix listed |
| redhat/python3.15(Red Hat:hummingbird:1) | All versions | No fix listed |
| redhat/container-native-virtualization/ocp-virt-validation-checkup-rhel9(Red Hat:container_native_virtualization:4) | All versions | No fix listed |
Show 113 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/container-native-virtualization/ocp-virt-validation-checkup-rhel9(Red Hat:container_native_virtualization:5) | All versions | No fix listed |
| redhat/ansible-automation-platform/bootc-automation-portal-rhel9(Red Hat:ansible_portal:2) | All versions | No fix listed |
| Python Software Foundation CPython | < 3.11.18 | 3.11.18 |
| Python Software Foundation CPython | >= 3.12.0, < 3.12.16 | 3.12.16 |
| Python Software Foundation CPython | >= 3.13.0, < 3.13.18 | 3.13.18 |
| Python Software Foundation CPython | >= 3.14.0, < 3.14.10 | 3.14.10 |
| Python Software Foundation CPython | >= 3.15.0, < 3.15.2 | 3.15.2 |
| Python Software Foundation CPython | >= 3.16.0a1, < 3.16.0 | 3.16.0 |
| debian/python3.11(Debian:12) | All versions | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.2-6 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.2-6+deb12u1 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.2-6+deb12u2 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.2-6+deb12u3 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.2-6+deb12u4 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.2-6+deb12u5 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.2-6+deb12u6 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.2-6+deb12u7 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.2-6+deb12u8 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.2-6+deb12u9 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.3-1 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.3-2 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.4-1 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.5-1 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.5-2 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.5-3 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.6-1 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.6-2 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.6-3 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.6-3~hurd.2 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.7-1 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.7-2 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.8-1 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.8-1.1~exp1 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.8-1.1~exp2 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.8-2 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.8-3 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.8-3+hurd.1 | No fix listed |
| debian/python3.11(Debian:12) | = 3.11.9-1 | No fix listed |
| debian/python3.13(Debian:13) | All versions | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.11-1 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.12-1 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.14-1 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.15-1 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.18-1 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.5-2 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.5-2+deb13u1 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.5-2+deb13u2 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.5-2+deb13u3 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.5-2+deb13u4 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.5-2+deb13u5 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.6-1 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.7-1 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.8-1 | No fix listed |
| debian/python3.13(Debian:13) | = 3.13.9-1 | No fix listed |
| debian/python3.14(Debian:14) | < 3.14.10-1 | 3.14.10-1 |
| debian/python3.14(Debian:14) | = 3.14.0-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0-2 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0-3 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0-4 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0-5 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0~a7-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0~b1-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0~b2-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0~b3-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0~b4-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0~rc1-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0~rc2-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.0~rc3-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.2-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.3-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.3-2 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.3-3 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.3-4 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.3-5 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.4-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.4-2 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.5-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.5~rc1-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.6-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.7-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.7-2 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.7-3 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.7-4 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.7-5 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.8-1 | No fix listed |
| debian/python3.14(Debian:14) | = 3.14.9-1 | No fix listed |
| debian/python3.15(Debian:14) | < 3.15.2-1 | 3.15.2-1 |
| debian/python3.15(Debian:14) | = 3.15.0-1 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~a8-1 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~a8-2 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~b1-1 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~b1-2 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~b1-3 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~b2-1 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~b3-1 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~b4-1 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~rc1-1 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~rc2-1 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~rc2-2 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~rc2-3 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~rc3-1 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.0~rc3-2 | No fix listed |
| debian/python3.15(Debian:14) | = 3.15.1-1 | No fix listed |
| ubuntu/python3.10(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/python2.7(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/python3.11(Ubuntu:22.04) | All versions | No fix listed |
| alpine/python3(Alpine:v3.21) | < 3.12.16-r0 | 3.12.16-r0 |
| alpine/python3(Alpine:v3.22) | < 3.12.16-r0 | 3.12.16-r0 |
| alpine/python3(Alpine:v3.23) | < 3.12.16-r0 | 3.12.16-r0 |
| alpine/python3(Alpine:v3.24) | < 3.14.10-r0 | 3.14.10-r0 |
| ubuntu/python3.12(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/python3.14(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/python3.14(Ubuntu:26.10) | All versions | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2560301 issue-tracking
- www.cve.org
- nvd.nist.gov
- emudhra.we-have-a-problem.com third-party-advisory
- github.com issue-tracking
- github.com patch
- mail.python.org vendor-advisory
- www.openwall.com related
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- www.openwall.com
- Debian Security Tracker CVE-2026-115557 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- security.alpinelinux.org vendor-advisory