CVE-2026-19552

EUVD-2026-120066
When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
PSFCNA
NONE
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
pythoncpython
𝑥
< 3.16.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
python3.11
bookworm
vulnerable
bookworm (security)
vulnerable
python3.13
sid
vulnerable
trixie
vulnerable
python3.14
forky
vulnerable
sid
vulnerable
python3.15
forky
vulnerable
sid
vulnerable
References
https://github.com/python/cpython/issues/161503
https://github.com/python/cpython/pull/161507
https://mail.python.org/archives/list/security-announce@python.org/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/