CVE-2026-115557: Distrust compromised intermediate certificates in ssl module
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Affected Software
Event History
Frequently Asked Questions
What configurations are protected by this change?
Known compromised certificates are automatically rejected regardless of the SSLContext policy configuration. This protection does not depend on certificate revocation being configured.
Who is exposed if this protection is not present?
Users whose Python TLS connections could encounter one of the known compromised certificates are the relevant affected population, particularly where certificate revocation is not configured. The provided information does not identify specific applications, platforms, or Python versions.
Can an SSLContext policy override acceptance of a denylisted certificate?
No. The denylist rejects known compromised certificates regardless of the SSLContext policy configuration.