Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• Alpine:v3.23 python30 → 3.12.16-r0
• Alpine:v3.24 python30 → 3.14.10-r0
• Debian:12 python3.113.11.2-6, 3.11.2-6+deb12u1, 3.11.2-6+deb12u2
• Debian:13 python3.133.13.11-1, 3.13.12-1, 3.13.14-1
• Debian:14 python3.133.13.11-1, 3.13.12-1, 3.13.14-1
• Debian:14 python3.143.14.0-1, 3.14.0-2, 3.14.0-3
• Debian:14 python3.153.15.0-1, 3.15.0~a8-1, 3.15.0~a8-2
• vendor Python Software Foundationversion unspecified
• vendor Python Software Foundation CPythonversion unspecified

How to fix CVE-2026-115557

• Upgrade

  CVE-2026-115557 lists a fix boundary at 3.12.16-r0. Compare the installed build with that boundary before you change production.

• Version check

  Fixed in 3.12.16-r0 · 13 other ranges on the advisory

• Advisory

  Open the cve_org record and follow its fix.

• Official advisories

  • CVE.org · cve.org
  • FIRST EPSS · first.org
  • EUVD · euvd.enisa.europa.eu
  • Openwall OSS Security · openwall.com
  • OpenSSF OSV / OSV Scanner · osv.dev
  • OpenSSF OSV / OSV Scanner · osv.dev

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Technology hubs

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 24, 2026 · OpenSSF OSV / OSV Scanner

   Detected

2. Oct 25, 2026 · OpenSSF OSV / OSV Scanner

   Updated

   The description or metadata changed.

3. Oct 25, 2026 · Trivy Vulnerability DB

   Updated

   Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

4. Oct 26, 2026 · EUVD

   Updated

   Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

5. Oct 27, 2026 · Trivy Vulnerability DB

   Fix available

   python3 fixed in 3.12.16-r0; python3 fixed in 3.14.10-r0

6. Oct 27, 2026 · Trivy Vulnerability DB

   Fix available

   python3 fixed in 3.12.16-r0

7. Oct 27, 2026 · Trivy Vulnerability DB

   Fix available

   python3 fixed in 3.14.10-r0

8. Oct 27, 2026 · Trivy Vulnerability DB

   Updated

   Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

Sources

• CVE.orgVulnerability recordCVE-2026-115557

  Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-115557

  30-day exploitation probability 0.53%

  first.org
• EUVDVulnerability recordEUVD-2026-109299

  Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

  euvd.enisa.europa.eu
• Openwall OSS SecurityThreat researchCVE-2026-115557

  Research mention from Openwall OSS Security. Not confirmation of exploitation.

  openwall.com
• OpenSSF OSV / OSV ScannerPackage advisoryALPINE-CVE-2026-115557
  osv.dev
• OpenSSF OSV / OSV ScannerPackage advisoryDEBIAN-CVE-2026-115557
  osv.dev
• Trivy Vulnerability DBPackage advisoryALPINE-CVE-2026-115557

  Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

  osv.dev
• Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-115557

  Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

  osv.dev

References

• EUVD reference · openwall.com
• EUVD reference · emudhra.we-have-a-problem.com
• EUVD record · euvd.enisa.europa.eu
• Reference · github.com
• Reference · github.com
• Reference · github.com
• EUVD reference · github.com
• EUVD reference · github.com
• EUVD reference · mail.python.org
• ADVISORY · security-tracker.debian.org
• ADVISORY · security.alpinelinux.org

Freshness

Last verified in this catalog Oct 25, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

• Trivy Vulnerability DBOct 28, 2026
• Openwall OSS SecurityOct 28, 2026
• OpenSSF OSV / OSV ScannerOct 28, 2026
• EUVDOct 26, 2026
• FIRST EPSSOct 25, 2026
• OpenSSF OSV / OSV ScannerOct 25, 2026
• CVE.orgOct 25, 2026
• Trivy Vulnerability DBOct 25, 2026