---
id: "CVE-2026-119170"
page: "https://infrastack.ai/live/CVE-2026-119170"
kind: "vulnerability"
aliases: ["CVE-2026-119170"]
title: "Python: hashlib FIPS regression lets blocked hash algorithms run on 3.14.10"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["fips", "openssl", "python", "runtime"]
not_affected_if: ["not-fips-mode", "other-python-versions"]
published_at: "2026-11-06T15:17:12+00:00"
first_seen_at: "2026-11-06T15:42:43+00:00"
updated_at: "2026-11-06T15:44:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119170", "first_seen_at": "2026-11-06T15:42:43+00:00"}]
exploit_sources: []
---

# Python: hashlib FIPS regression lets blocked hash algorithms run on 3.14.10

Link for people: https://infrastack.ai/live/CVE-2026-119170 (this .md is for agents)

A regression in Python 3.14.10 stopped hashlib from enforcing FIPS restrictions on hash algorithms when Python uses OpenSSL in FIPS mode. Only that one release is affected, and the sources do not describe a direct way for an attacker to exploit it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `python3 --version` and confirm whether it reports `3.14.10`.
- Check whether Python is linked against OpenSSL in FIPS mode (the sources do not name a specific command).

## Fix

- Python `3.14.10` is the affected release; the sources say all other Python versions are unaffected, but do not name the fixed version.

## Timeline

- 2026-11-06T15:42:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119170

## Documents

- [advisory] Python security-announce: [Security-announce][CVE-2026-119170] Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10 https://mail.python.org/archives/list/security-announce@python.org/message/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/

## From the sources

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_