CVE-2026-19552: ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity
Published Nov 9, 2026
·Updated
When cacerts parameter was supplied to ssl.getservercertificate() f ...
Affected Software
8 affected components
Python Software Foundation CPython
debian/python3.11*
debian/python3.13*
debian/python3.14*
debian/python3.11<=3.11.2-6+deb12u8, <=3.11.2-6+deb12u9
debian/python3.13<=3.13.5-2+deb13u5, <=3.13.18-1
debian/python3.14<=3.14.10-1
debian/python3.15<=3.15.2-1
Event History
Nov 9, 2026
CVE Published
via MITRE·02:15 PM
Data Sourced
via MITRE·02:15 PM
Description
Data Sourced
via OSV·02:15 PM
DescriptionSeverity
Data Sourced
via NVD·03:17 PM
DescriptionSeverity
Nov 10, 2026
Data Sourced
via OSV·02:00 AM
Affected Software
Frequently Asked Questions
1
Which uses are affected?
Uses of ssl.get_server_certificate() that supply the ca_certs parameter are affected. In that case, the certificate chain is verified, but the certificate identity is not checked.
2
How can I identify potentially affected code?
Review code for calls to ssl.get_server_certificate() that pass ca_certs. Those calls should not be treated as confirming that the returned certificate belongs to the intended server identity.