CPython [CVE-2026-19553] SSLContext.wrap_bio() missing validation of server_hostname parameter

CVE-2026-19553 is a certificate hostname-verification flaw (CWE-297) in CPython’s ssl module. SSLContext.wrap_bio() did not require server_hostname to be non-None when SSLContext.check_hostname was set, and a missing check in SSLObject caused hostname verification to be silently skipped when that argument was not supplied. A peer that presents a certificate for a different name can then complete a TLS handshake the application believes was hostname-checked, because no ValueError is raised. Programs that pass a non-empty, non-None server_hostname to wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() are not affected; exact Python version ranges are not stated in the advisory. No public proof of concept is known and the issue is not in CISA’s Known Exploited Vulnerabilities catalog.

Do: Audit calls to SSLContext.wrap_bio(), asyncio.create_connection(), and asyncio.loop.start_tls() and always pass a non-empty, non-None server_hostname whenever check_hostname is enabled. Upgrading to a patched Python or applying the upstream fix does not itself perform verification; it only makes a missing server_hostname raise ValueError instead of silently skipping the check. Treat any TLS client that sets check_hostname without supplying server_hostname as unverified until that call is corrected.