AZL-112919: CVE-2026-19552 affecting package python3 3.12.16-1

Q: What condition is required for this issue to occur?

The issue occurs when the ca_certs parameter is supplied to ssl.get_server_certificate(). Under that condition, the certificate's identity is not checked.

Q: What is the security consequence of using this function with ca_certs?

A certificate may be accepted without verifying that its identity matches the intended server. This affects uses of ssl.get_server_certificate() that provide ca_certs.

Published Nov 9, 2026

Updated

When cacerts parameter was supplied to ssl.getservercertificate() function, the identity of the certificate is not checked.

Affected Software

1 affected component

azure-linux/python3<=3.12.16-1

Event History

Nov 9, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-19552

Frequently Asked Questions

What condition is required for this issue to occur?

The issue occurs when the ca_certs parameter is supplied to ssl.get_server_certificate(). Under that condition, the certificate's identity is not checked.

What is the security consequence of using this function with ca_certs?

A certificate may be accepted without verifying that its identity matches the intended server. This affects uses of ssl.get_server_certificate() that provide ca_certs.

AZL-112919: CVE-2026-19552 affecting package python3 3.12.16-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What condition is required for this issue to occur?

What is the security consequence of using this function with ca_certs?

Company

Resources

Contact

Frequently Asked Questions

What condition is required for this issue to occur?

What is the security consequence of using this function with ca_certs?