CVE-2026-19552 · Runtime
NO FIX YET
When a ca_certs file is passed to ssl.get_server_certificate(), Python verifies the certificate chain but does not check that the certificate matches the server's identity. A script relying on this call could be fooled into trusting a certificate that was issued for another host.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only code that calls ssl.get_server_certificate() with the ca_certs parameter is exposed, because that combination skips the identity check. Services that do not call this function, or that fetch certificates another way, are not affected by this entry. The sources do not state which Python versions are affected.
Not affected if no-ca-certs-argument, no-get-server-certificate-calls
Who cares python
ssl.get_server_certificate( that pass ca_certs=python3 --version against the fixed versions belowNo fix yet, per the sources.
When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.