Vulnerability-Lookup

OESA-2026-4525 (CVE-2026-19553)

Vulnerability from osv_openeuler – Published: 2026-10-22 14:36 – Updated: 2026-10-22 14:36 – Source website

Summary

python3 security update

Details

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

This defect could lead to programs where certificate hostname verification appeared to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration.

If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability.

Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied.(CVE-2026-19553)

Severity

7.6 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-19553	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "python3-3.9.9-62.oe2203sp4.aarch64.rpm",
          "python3-debug-3.9.9-62.oe2203sp4.aarch64.rpm",
          "python3-debuginfo-3.9.9-62.oe2203sp4.aarch64.rpm",
          "python3-debugsource-3.9.9-62.oe2203sp4.aarch64.rpm",
          "python3-devel-3.9.9-62.oe2203sp4.aarch64.rpm",
          "python3-unversioned-command-3.9.9-62.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "python3-help-3.9.9-62.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "python3-3.9.9-62.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "python3-3.9.9-62.oe2203sp4.x86_64.rpm",
          "python3-debug-3.9.9-62.oe2203sp4.x86_64.rpm",
          "python3-debuginfo-3.9.9-62.oe2203sp4.x86_64.rpm",
          "python3-debugsource-3.9.9-62.oe2203sp4.x86_64.rpm",
          "python3-devel-3.9.9-62.oe2203sp4.x86_64.rpm",
          "python3-unversioned-command-3.9.9-62.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "python3",
        "purl": "pkg:rpm/openEuler/python3\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.9-62.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.\r\n\r\nSecurity Fix(es):\n\nssl.SSLContext.wrap_bio() didn\u0026apos;t require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn\u0026apos;t supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn\u0026apos;t an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn\u0026apos;t require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn\u0026apos;t supplied.(CVE-2026-19553)",
  "id": "OESA-2026-4525",
  "modified": "2026-10-22T14:36:11Z",
  "published": "2026-10-22T14:36:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4525"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19553"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "python3 security update",
  "upstream": [
    "CVE-2026-19553"
  ]
}

CVE-2026-19553 (GCVE-0-2026-19553)

Vulnerability from cvelistv5 – Published: 2026-09-30 16:17 – Updated: 2026-10-16 18:33

Title

SSLContext.wrap_bio() missing validation of server_hostname parameter

Summary

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 18:33 UTC

CWE

CWE-297

Assigner

PSF CNA under the mitre root

CNA scorecard B 80/100 over 27 records in the last 180 days details

References

11 references

URL	Tags
https://github.com/python/cpython/pull/158503	patch
https://github.com/python/cpython/issues/156793	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/1697ea38…	patch
https://github.com/python/cpython/commit/64139014…	patch
https://github.com/python/cpython/commit/966bf426…	patch
https://github.com/python/cpython/commit/f4e43ba5…	patch
https://github.com/python/cpython/commit/869069d5…	patch
https://github.com/python/cpython/commit/5867d4e4…	patch
https://github.com/python/cpython/commit/bdebbf9b…	patch
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.10.22 (python) Affected: 3.11.0 , < 3.11.17 (python) Affected: 3.12.0 , < 3.12.15 (python) Affected: 3.13.0 , < 3.13.16 (python) Affected: 3.14.0 , < 3.14.8 (python) Affected: 3.15.0a1 , < 3.15.0rc3 (python)

Credits

devdanzin (https://github.com/devdanzin) Bhuvansh (https://github.com/BHUVANSH855) Bénédikt Tran (https://github.com/picnixz) Seth Larson (https://github.com/sethmlarson)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-30T18:09:40.939Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/30/16"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19553",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:33:08.291056Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:33:12.475Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "ssl"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.10.22",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.17",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.15",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.16",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.8",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0rc3",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "devdanzin (https://github.com/devdanzin)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Bhuvansh (https://github.com/BHUVANSH855)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "B\u00e9n\u00e9dikt Tran (https://github.com/picnixz)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson (https://github.com/sethmlarson)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "type": "text/html",
              "value": "\u003cp\u003e\u003ccode\u003essl.SSLContext.wrap_bio()\u003c/code\u003e didn\u0027t require the \u003ccode\u003eserver_hostname\u003c/code\u003e argument\nto not be \u003ccode\u003eNone\u003c/code\u003e if \u003ccode\u003essl.SSLContext.check_hostname\u003c/code\u003e was set. Due to a\nmissing parameter check in \u003ccode\u003eSSLObject\u003c/code\u003e, if the \u003ccode\u003eserver_hostname\u003c/code\u003e argument\nisn\u0027t supplied then hostname verification would be silently skipped.\u003c/p\u003e\n\u003cp\u003eThis defect could lead to programs where certificate hostname verification\n\u003cem\u003e*appeared*\u003c/em\u003e to be succeeding with \u003ccode\u003eSSLContext.check_hostname = True\u003c/code\u003e and no\n\u003ccode\u003eValueError\u003c/code\u003e being raised due to misconfiguration.\u003c/p\u003e\n\u003cp\u003eIf the program passes a \u003ccode\u003eserver_hostname\u003c/code\u003e value that isn\u0027t an empty string\nor \u003ccode\u003eNone\u003c/code\u003e to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\u003c/p\u003e\n\u003cp\u003eMitigating this vulnerability doesn\u0027t require updating Python or applying\nthe patch. To mitigate, pass a valid non-\u003ccode\u003eNone\u003c/code\u003e and non-empty\n\u003ccode\u003eserver_hostname\u003c/code\u003e value to \u003ccode\u003eSSLContext.wrap_bio()\u003c/code\u003e,\n\u003ccode\u003easyncio.create_connection()\u003c/code\u003e, or \u003ccode\u003easyncio.loop.start_tls()\u003c/code\u003e and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\n\u003ccode\u003eValueError\u003c/code\u003e, similar to \u003ccode\u003eSSLContext.wrap_socket()\u003c/code\u003e, when \u003ccode\u003eserver_hostname\u003c/code\u003e\nisn\u0027t supplied.\u003c/p\u003e"
            }
          ],
          "value": "ssl.SSLContext.wrap_bio() didn\u0027t require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn\u0027t supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn\u0027t an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn\u0027t require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn\u0027t supplied."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "CWE-297",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T00:36:35.156Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/158503"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/156793"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SSLContext.wrap_bio() missing validation of server_hostname parameter",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-19553",
    "datePublished": "2026-09-30T16:17:39.368Z",
    "dateReserved": "2026-08-11T15:22:03.833Z",
    "dateUpdated": "2026-10-16T18:33:12.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted