CVE-2026-115557: Distrust compromised intermediate certificates in ssl module

Published Oct 24, 2026
·
Updated

Distrust compromised intermediate certificates in ssl module

Other sources

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

— Ubuntu

Affected Software

43 affected componentsFixes available
Python Software Foundation Python ssl module
All of the following
azurelinux/python3<3.12.15-3
3.12.15-3
Microsoft Azure Linux=3.0
ubuntu/python2.7*
ubuntu/python3.4*
ubuntu/python3.5*
ubuntu/python2.7*
ubuntu/python3.5*
ubuntu/python2.7*
ubuntu/python3.6*
ubuntu/python3.7*
ubuntu/python3.8*
ubuntu/python2.7*
ubuntu/python3.9*
ubuntu/python3.10*
ubuntu/python2.7*
ubuntu/python3.11*
ubuntu/python3.12*
ubuntu/python3.14*
ubuntu/python3.14*
bitnami/libpython<3.11.18
3.11.18
bitnami/libpython>=3.12.0<3.12.16
3.12.16
bitnami/libpython>=3.13.0<3.13.18
3.13.18
bitnami/libpython>=3.14.0<3.14.10
3.14.10
bitnami/libpython>=3.15.0<3.15.2
3.15.2
bitnami/python<3.11.18
3.11.18
bitnami/python>=3.12.0<3.12.16
3.12.16
bitnami/python>=3.13.0<3.13.18
3.13.18
bitnami/python>=3.14.0<3.14.10
3.14.10
bitnami/python>=3.15.0<3.15.2
3.15.2
bitnami/python-min<3.11.18
3.11.18
bitnami/python-min>=3.12.0<3.12.16
3.12.16
bitnami/python-min>=3.13.0<3.13.18
3.13.18
bitnami/python-min>=3.14.0<3.14.10
3.14.10
bitnami/python-min>=3.15.0<3.15.2
3.15.2
debian/python3.11*
debian/python3.13*
debian/python3.14<3.14.10-1
3.14.10-1
debian/python3.15<3.15.2-1
3.15.2-1
debian/python3.11<=3.11.2-6+deb12u8, <=3.11.2-6+deb12u9
debian/python3.13<=3.13.5-2+deb13u5
3.13.18-1
debian/python3.14
3.14.10-1
debian/python3.15
3.15.2-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade azurelinux/python3 to a version that resolves this vulnerability.

    Fixed in 3.12.15-3
  2. Upgrade

    Upgrade debian/python3.13 to a version that resolves this vulnerability.

    Fixed in 3.13.18-1
  3. Upgrade

    Upgrade debian/python3.14 to a version that resolves this vulnerability.

    Fixed in 3.14.10-1
  4. Upgrade

    Upgrade debian/python3.15 to a version that resolves this vulnerability.

    Fixed in 3.15.2-1
  5. Upgrade

    Upgrade bitnami/libpython to a version that resolves this vulnerability.

    Fixed in 3.11.18
  6. Upgrade

    Upgrade bitnami/libpython to a version that resolves this vulnerability.

    Fixed in 3.12.16
  7. Upgrade

    Upgrade bitnami/libpython to a version that resolves this vulnerability.

    Fixed in 3.13.18
  8. Upgrade

    Upgrade bitnami/libpython to a version that resolves this vulnerability.

    Fixed in 3.14.10
  9. Upgrade

    Upgrade bitnami/libpython to a version that resolves this vulnerability.

    Fixed in 3.15.2
  10. Upgrade

    Upgrade bitnami/python to a version that resolves this vulnerability.

    Fixed in 3.11.18
  11. Upgrade

    Upgrade bitnami/python to a version that resolves this vulnerability.

    Fixed in 3.12.16
  12. Upgrade

    Upgrade bitnami/python to a version that resolves this vulnerability.

    Fixed in 3.13.18
  13. Upgrade

    Upgrade bitnami/python to a version that resolves this vulnerability.

    Fixed in 3.14.10
  14. Upgrade

    Upgrade bitnami/python to a version that resolves this vulnerability.

    Fixed in 3.15.2
  15. Upgrade

    Upgrade bitnami/python-min to a version that resolves this vulnerability.

    Fixed in 3.11.18
  16. Upgrade

    Upgrade bitnami/python-min to a version that resolves this vulnerability.

    Fixed in 3.12.16
  17. Upgrade

    Upgrade bitnami/python-min to a version that resolves this vulnerability.

    Fixed in 3.13.18
  18. Upgrade

    Upgrade bitnami/python-min to a version that resolves this vulnerability.

    Fixed in 3.14.10
  19. Upgrade

    Upgrade bitnami/python-min to a version that resolves this vulnerability.

    Fixed in 3.15.2

Event History

Oct 24, 2026
CVE Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·02:15 PM
Advisory Published
via OSV·02:15 PM
Data Sourced
via OSV·02:15 PM
Description
Data Sourced
via MITRE·02:15 PM
DescriptionWeakness
Data Sourced
via OSV·02:15 PM
SeverityWeakness
Data Sourced
via Red Hat·02:31 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Oct 26, 2026
Data Sourced
via Microsoft·08:03 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:03 AM
Affected Software
Oct 28, 2026
Data Sourced
via OSV·05:50 PM
Affected Software

Frequently Asked Questions

1

What configurations are protected by this change?

Known compromised certificates are automatically rejected regardless of the SSLContext policy configuration. This protection does not depend on certificate revocation being configured.

2

Who is exposed if this protection is not present?

Users whose Python TLS connections could encounter one of the known compromised certificates are the relevant affected population, particularly where certificate revocation is not configured. The provided information does not identify specific applications, platforms, or Python versions.

3

Can an SSLContext policy override acceptance of a denylisted certificate?

No. The denylist rejects known compromised certificates regardless of the SSLContext policy configuration.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203