Regression in FIPS enforcement of hash algorithms affects only Python 3.14.10
The regression is HIGH severity and affects only CPython 3.14.10.
40
Vulnerability1 · 1 read
CVE-2026-119170
FIPS enforcement regression in Python hashlib (OpenSSL FIPS mode)
- CVSS 4.0
- 8.2 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A regression in FIPS algorithms enforcement affects the hashlib module. Only users running OpenSSL in FIPS mode on Python 3.14.10 are impacted. An attacker gains weaker FIPS compliance. All Python 3.14.10 users in FIPS mode are affected.
What to do: Upgrade Python to any version except 3.14.10. No workaround listed.
| Product | Affected |
|---|---|
| Python | 3.14.10 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.
- Weakness
- CWE-693
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X