AI analysis
CVE-2026-19553 is a certificate hostname-verification flaw (CWE-297) in CPython’s ssl module. SSLContext.wrap_bio() did not require server_hostname to be non-None when SSLContext.check_hostname was set, and a missing check in SSLObject caused hostname verification to be silently skipped when that argument was not supplied. A peer that presents a certificate for a different name can then complete a TLS handshake the application believes was hostname-checked, because no ValueError is raised. Programs that pass a non-empty, non-None server_hostname to wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() are not affected; exact Python version ranges are not stated in the advisory. No public proof of concept is known and the issue is not in CISA’s Known Exploited Vulnerabilities catalog.
What to do: Audit calls to SSLContext.wrap_bio(), asyncio.create_connection(), and asyncio.loop.start_tls() and always pass a non-empty, non-None server_hostname whenever check_hostname is enabled. Upgrading to a patched Python or applying the upstream fix does not itself perform verification; it only makes a missing server_hostname raise ValueError instead of silently skipping the check. Treat any TLS client that sets check_hostname without supplying server_hostname as unverified until that call is corrected.
Affected
| Python Software Foundation CPython (ssl module) | — |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied.