---
id: CVE-2026-115557
title: Distrust compromised intermediate certificates in ssl module
summary: >-
  Python has added a denylist for known compromised certificates to the "ssl"
  module to ensure user safety even without certificate revocation configured.
  Known compromised certificates will automatically be rejected regardless of
  the SSLC…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-299
vendor: Python Software Foundation
product: CPython
affected:
  - CPython <= 3.16.0
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:20:50.539Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115557'
references:
  - url: 'http://www.openwall.com/lists/oss-security/2026/10/20/29'
  - url: 'https://github.com/python/cpython/pull/160042'
  - url: 'https://github.com/python/cpython/issues/160040'
  - url: 'https://emudhra.we-have-a-problem.com/'
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/
tags:
  - cve.org
ingestedAt: '2026-10-24T15:00:18.042Z'
---

## Overview

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

## Affected

- `CPython <= 3.16.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.