AZL-111101: CVE-2026-115557 affecting package python3 3.12.14-2

Q: What certificate-validation behavior changes with this update?

The ssl module adds a denylist for known compromised certificates. Certificates on that denylist are automatically rejected even when certificate revocation is not configured and regardless of SSLContext policy settings.

Q: Are deployments without certificate revocation checking affected?

Yes. The stated purpose of the change is to protect users even when certificate revocation is not configured, so environments relying only on their existing SSLContext policy may not reject these known compromised certificates without the update.

Published Oct 24, 2026

Updated

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

Affected Software

1 affected component

azure-linux/python3<=3.12.14-2

Event History

Oct 24, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115557

Frequently Asked Questions

What certificate-validation behavior changes with this update?

The ssl module adds a denylist for known compromised certificates. Certificates on that denylist are automatically rejected even when certificate revocation is not configured and regardless of SSLContext policy settings.

Are deployments without certificate revocation checking affected?

Yes. The stated purpose of the change is to protect users even when certificate revocation is not configured, so environments relying only on their existing SSLContext policy may not reject these known compromised certificates without the update.

AZL-111101: CVE-2026-115557 affecting package python3 3.12.14-2

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What certificate-validation behavior changes with this update?

Are deployments without certificate revocation checking affected?

Company

Resources

Contact

Frequently Asked Questions

What certificate-validation behavior changes with this update?

Are deployments without certificate revocation checking affected?