CPython skips server identity checks in ssl.get_server_certificate
Original title: CPython: [CVE-2026-19552] ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity
Python rates CVE-2026-19552 low: with ca_certs set, the call checks the chain but not the server identity.
Seth Larson announced a low-severity CPython flaw, CVE-2026-19552, and Alan Coopersmith forwarded it to oss-security on November 9. ssl.get_server_certificate verifies the certificate chain when ca_certs is supplied but never checks the server identity. The forwarded notice is cut off after that condition, with no affected versions, fix, or exploitation status given.
Unconfirmed: The notice is truncated, so affected versions, the fix, and exploitation status are not stated.
- Python's security-announce list calls the issue low severity.
- The notice is dated November 9, 2026, and was forwarded the same day.
- The public snippet ends while describing the ca_certs parameter.
Impact: Server identity is not verified when ca_certs is set
| Product | Affected |
|---|---|
| CPython | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19552 | Missing identity check in CPython ssl.get_server_certificate | 0.0 | — |
From the original article
Posted by Alan Coopersmith on Nov 09 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-19552] ssl. get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity Date: Mon, 9 Nov 2026 14:12:16 +0000 From: Seth Larson Reply-To: security-sig () python org To: security-announce () python org There is a LOW severity vulnerability affecting CPython.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.