Description
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.11.18, 3.12.0 – < 3.12.16, 3.13.0 – < 3.13.18, 3.14.0 – < 3.14.10, 3.15.0 – < 3.15.2, 3.16.0a1 – < 3.16.0 | 3.11.18 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python3.14 | 3.14.10-1 | — |
| Debian 14 | python3.15 | 3.15.2-1 | — |
| Debian 13 | python3.13 | No fix yet | — |
| Debian 12 | python3.11 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python3.14 | No fix yet | — |
| Ubuntu 26.04 LTS | python3.14 | No fix yet | — |
| Ubuntu 24.04 LTS | python3.12 | No fix yet | — |
| Ubuntu 22.04 LTS | python3.10 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python2.7 +2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python2.7 +3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python2.7 +2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | python3 +8 | 3.9.25-16.el9_9 | RHSA-2026:98533 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python3 +15 | 3.14.10-1.hum1 | RHSA-2026:92066 |
| Red Hat Hardened Images 1 | python3.11 +6 | 3.11.18-1.hum1 | RHSA-2026:90986 |
| Red Hat Hardened Images 1 | python3.12 +6 | 3.12.16-1.hum1 | RHSA-2026:90533 |
| Red Hat Hardened Images 1 | python3.13 +8 | 3.13.18-1.hum1 | RHSA-2026:90995 |
| Red Hat Hardened Images 1 | python3.15 +13 | 3.15.2-0.1.hum1 | RHSA-2026:90305 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | python3 +7 | 3.9.25-16.el9_9 | RLSA-2026:98533 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python310 | 3.10.22-3.1 | openSUSE-SU-2026:12504-1 |
| openSUSE Tumbleweed | python315 | 3.15.2-1.1 | openSUSE-SU-2026:12348-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | python3 | 3.14.10-r0 | — |
| Alpine v3.23 | python3 | 3.12.16-r0 | — |
| Alpine v3.22 | python3 | 3.12.16-r0 | — |
| Alpine v3.21 | python3 | 3.12.16-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3.11 +6 | 3.11.18-1.amzn2023.0.1 | ALAS2023-2026-3356 |
| Amazon Linux 2023 | python3.12 +6 | 3.12.16-2.amzn2023.0.1 | ALAS2023-2026-3408 |
| Amazon Linux 2023 | python3.13 +8 | 3.13.18-1.amzn2023.0.1 | ALAS2023-2026-3407 |
| Amazon Linux 2023 | python3.14 +13 | 3.14.10-1.amzn2023.0.1 | ALAS2023-2026-3406 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
| Azure Linux 3 | python3 | 3.12.15-3 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | python-3.10 | No fix yet | — |
| Wolfi rolling | python-3.13 | 3.13.18_git20261030-r0 | — |
| Wolfi rolling | python-3.14 | 3.14.10_git20261028-r0 | — |
| Wolfi rolling | python-3.15 | 3.15.2_git20261030-r0 | — |
Advisories 14
- RHSA-2026:98533 Red Hat Security Advisory: python3.9 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:92066 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:90995 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:90986 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:90533 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:90305 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98533 Moderate: python3.9 security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4189 Python: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- openSUSE-SU-2026:12504-1 python310-3.10.22-3.1 on GA media SUSE / openSUSE Security Updates · Nov 10, 2026
- ALAS2023-2026-3406 Moderate: python3.14 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3407 Moderate: python3.13 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3408 Moderate: python3.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3356 Moderate: python3.11 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 2, 2026
- openSUSE-SU-2026:12348-1 python315-3.15.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 31, 2026
References
- http://www.openwall.com/lists/oss-security/2026/10/20/29 related
- https://github.com/python/cpython/pull/160042 patch
- https://github.com/python/cpython/issues/160040 issue-tracking
- https://emudhra.we-have-a-problem.com/ third-party-advisory
- https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/ vendor-advisory
- https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d patch
- https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd patch
- https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93 patch
- https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6 patch
- https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5 patch
- https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b patch
- https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90 patch
- https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8 patch
- https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78 patch
- https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370 patch
- https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e patch
- https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3 patch