Three separate CPython notices were clustered as one story
First merged summary.
The reports describe three unrelated CPython security notices, not one shared vulnerability or incident.
The three oss-security items are separate forwarded CPython security-announce notices and do not describe one event. CVE-2026-19552, announced November 9, is rated low: with ca_certs set, ssl.get_server_certificate checks the chain but not server identity. CVE-2026-115791, announced November 10, is rated medium and concerns stdlib shadowing in the gzip, tarfile, and zipfile CLIs. CVE-2026-115559, also announced November 10, concerns imaplib STARTTLS serving pre-handshake plaintext as if it arrived over TLS. None of the excerpts states affected or fixed versions or an exploitation status.
- CVE-2026-19552 is rated low and concerns missing server-identity checks.
- CVE-2026-115791 is rated medium and concerns CLI stdlib shadowing.
- CVE-2026-115559 concerns imaplib STARTTLS treating buffered plaintext as TLS data.
- No excerpt gives affected versions, fixes, or exploitation status.
Timeline
dated events in the reporting · oldest first- Nov 9, 2026Low-severity CVE-2026-19552 notice forwarded to oss-security · oss-security
- Nov 10, 2026Medium-severity CVE-2026-115791 notice forwarded to oss-security · oss-security
- Nov 10, 2026CVE-2026-115559 imaplib notice forwarded to oss-security · oss-security
What each outlet adds
beyond the shared facts- oss-securityThree distinct November 9–10 CPython notices, each a separate CVE
- Vendors
- Python
Coverage
oldest first · one row per article · UTC- · 2d ago
oss-securityFirst report
CPython skips server identity checks in ssl.get_server_certificate
Python rates CVE-2026-19552 low: with ca_certs set, the call checks the chain but not the server identity.
- · 22h ago
CPython gzip, tarfile, and zipfile CLIs can shadow stdlib (CVE-2026-115791)
Python's security list rates the flaw medium; the excerpt gives no fixed version or exploitation status.
- · 22h ago
CPython imaplib STARTTLS can treat buffered plaintext as TLS
The forwarded notice covers CVE-2026-115559; the snippet gives no versions, fix, or exploitation status.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115559 | STARTTLS response injection in CPython imaplib | 6.3 | — | ||
| CVE-2026-115791 | Stdlib module shadowing in CPython tarfile/zipfile CLI | 5.3 | — | ||
| CVE-2026-19552 | Missing identity check in CPython ssl.get_server_certificate | 0.0 | — |