Vulnerability record/PUBLISHED/Published Oct 24, 2026 14:15:14 UTC

CVE-2026-115557

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

Base score9.4/ 10

SeverityCriticalCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityCritical

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredNonePR

User interactionPassiveUI

Vulnerable system confidentialityHighVC

Vulnerable system integrityHighVI

Vulnerable system availabilityHighVA

Subsequent system confidentialityHighSC

Subsequent system integrityHighSI

Subsequent system availabilityHighSA

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityPSF

Last updatedOct 24, 2026 18:07:53 UTC

PublishedOct 24, 2026 14:15:14 UTC

ReservedOct 22, 2026 21:32:20 UTC