CVE-2026-119170

CVSS 8.2 (high) · published 2026-11-06

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.

Weakness: CWE-693

Source: NVD CVE-2026-119170

References

• https://github.com/python/cpython/issues/160923
• https://github.com/python/cpython/pull/160984
• https://mail.python.org/archives/list/[email protected]/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/
• http://www.openwall.com/lists/oss-security/2026/11/06/30

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.