Skip to content
OpenAdvisories
High · 8.2 CVE-2026-119170 EUVD-2026-118275GHSA-vq78-g94j-3ppp

Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

Published Nov 6, 2026 · Updated Nov 6, 2026 · Assigned by PSF

Vendor: Python Software Foundation Product: CPython Package: python-3.14 Package: python2.7 Package: python3.10 Package: python3.11 Package: python3.12 Package: python3.14 Package: python3.14 Package: python3.4 Package: python3.5 Package: python3.6 Package: python3.7 Package: python3.8 Package: python3.9 Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.

Affected products

VendorProductAffectedFixed
Python Software Foundation CPython 3.14.10 – < 3.14.11 3.14.11

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 python3.14 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 python3.14 No fix yet —
Ubuntu 26.04 LTS python3.14 No fix yet —
Ubuntu 24.04 LTS python3.12 No fix yet —
Ubuntu 22.04 LTS python3.10 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 20.04 LTS python2.7 +2 No fix yet —
Ubuntu Pro 18.04 LTS python2.7 +3 No fix yet —
Ubuntu Pro 16.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 14.04 LTS python2.7 +2 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling python-3.14 3.14.10_git20261111-r0 —

References