CVE-2026-19552

CVSS 0.0 (none) · published 2026-11-09

When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.

Weakness: CWE-295

Source: NVD CVE-2026-19552

References

• https://github.com/python/cpython/commit/8dde46eaa6baf5f027a7234845b20d50b509624e
• https://github.com/python/cpython/issues/161503
• https://github.com/python/cpython/pull/161507
• https://mail.python.org/archives/list/[email protected]/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/
• http://www.openwall.com/lists/oss-security/2026/11/09/25

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.