Python ssl module denylists compromised intermediates (CVE-2026-115557)
Original title: [oss-security][CVE-2026-115557] Distrust compromised intermediate certificates in Python ssl module
The notice says the denylist should protect users even when those certificates are not yet removed elsewhere.
Seth Larson told Python’s security-announce list that the ssl module now carries a denylist of known compromised intermediate certificates. Alan Coopersmith forwarded the October 24, 2026 notice to oss-security. The available text is cut off and does not name releases or the certificates.
Unconfirmed: The forwarded notice is truncated, so affected releases and the certificates are not shown.
- The notice is dated October 24, 2026.
- Alan Coopersmith forwarded it to oss-security.
- No Python versions or certificate names appear in the snippet.
Impact: Continued trust of known compromised intermediate certificates
| Product | Affected |
|---|---|
| Python ssl module | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115557 | Python ssl does not reject known compromised certificates | 9.4 | — |
From the original article
Posted by Alan Coopersmith on Oct 24 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-115557] Distrust compromised intermediate certificates in ssl module Date: Sat, 24 Oct 2026 14:20:01 +0000 From: Seth Larson Reply-To: security-sig () python org To: security-announce () python org Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even…
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.