CVE-2026-119170 · Runtime
NO FIX YET · SEE WHAT TO DO
A regression in Python 3.14.10 stopped hashlib from enforcing FIPS restrictions on hash algorithms when Python uses OpenSSL in FIPS mode. Only that one release is affected, and the sources do not describe a direct way for an attacker to exploit it.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only systems running Python 3.14.10 with OpenSSL in FIPS mode are affected, according to the Python security announcement. Other Python versions and systems not running in FIPS mode are stated to be unaffected. Teams running FIPS-mode servers on 3.14.10 should look at this first.
Not affected if not-fips-mode, other-python-versions
Who cares fips, openssl, python
python3 --version and confirm whether it reports 3.14.10.3.14.10 is the affected release; the sources say all other Python versions are unaffected, but do not name the fixed version.There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.