Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-115557US | — | — | ||
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certifica… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/10/20/29WEB
- https://emudhra.we-have-a-problem.com/WEB
- https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854dFIX
- https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41ddFIX
- https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93FIX
- https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6FIX
- https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5FIX
- https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5bFIX
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan