Live › vulnerability › CVE-2026-115557
Go to dashboardPython's ssl module now rejects any certificate chain containing one of the compromised eMudhra/emSign intermediate CA keys (matched by DER SPKI), as defense in depth. The 9.4 score reflects the CA compromise (keys with trivially small private values) enabling man-in-the-middle attacks on TLS clients, not a bug an attacker triggers in Python. The denylist is skipped with verify_mode=CERT_NONE. Backports to 3.11-3.15 are merged-pending; no released patch versions confirmed yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 16:18 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| cpython | runtime | < 3.16.0 (per CVE record; backports to 3.11-3.15 pending) | 3.16.0 |
import sys;print(sys.version) and compare against releases carrying gh-160040 (not yet released as of 2026-10-25; check python.org release notes for 3.11-3.15 security releases)26.2.2 (python -m pip --version certifi >= 2026.10.19, uv >= 0.13.4, sigstore >= 4.5.1, conda >= 26.9.4, pixi >= 0.82.1, and rebuild container images with fresh ca-certificates, since pip and bundled certifi still trust eMudhra roots otherwise26.2.2, certifi to >= 2026.10.19, uv >= 0.13.4, sigstore 4.5.1, conda 26.9.4, pixi 0.82.1, and update OS ca-certificatesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-115557")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.