CVE-2026-19552
ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.
| Vendor | python software foundation |
| Product | cpython |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.16.0
References
github.com: https://github.com/python/cpython/pull/161507 github.com: https://github.com/python/cpython/issues/161503 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/ openwall.com: http://www.openwall.com/lists/oss-security/2026/11/09/25
Credits
🔍 devdanzin (https://github.com/devdanzin) Bhuvansh (https://github.com/BHUVANSH855) Bénédikt Tran (https://github.com/picnixz) Brett Smith (https://github.com/brettcs) Kirill Podoprigora (https://github.com/Eclips4) Gregory P. Smith (https://github.com/gpshead) Seth Larson (https://github.com/sethmlarson) devdanzin (https://github.com/devdanzin)