CVE-2026-119170: Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

Published Nov 6, 2026

Updated

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.

Event History

Nov 6, 2026

CVE Published

via MITRE·02:50 PM

Data Sourced

via MITRE·02:50 PM

Description

Frequently Asked Questions

Which deployments are exposed to this regression?

Only deployments running Python 3.14.10 with OpenSSL operating in FIPS mode are affected. Other Python versions are unaffected.

How can I determine whether this applies to my environment?

Verify both the Python runtime version and whether the OpenSSL instance used by that runtime is in FIPS mode. The regression applies only when the runtime is Python 3.14.10 and OpenSSL FIPS mode is enabled.

What is the immediate remediation priority?

Move away from Python 3.14.10, since the issue is limited to that version. Deployments not using OpenSSL in FIPS mode are not affected by this regression.

CVE-2026-119170: Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

Event History

Frequently Asked Questions

Which deployments are exposed to this regression?

How can I determine whether this applies to my environment?

What is the immediate remediation priority?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this regression?

How can I determine whether this applies to my environment?

What is the immediate remediation priority?