Read the docs
TI-2026-15902 Aliases CVE-2026-19553GHSA-xx9w-qm94-hghj

SSLContext.wrap_bio() missing validation of server_hostname parameter

Priority LOW 36CWE-297Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 22 fixed, 6 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00547 46th percentileScored 2026-11-07
Fix Partial CPython (Python Software Foundation): 3.10.22, 3.11.17, 3.12.15 +3Red Hat: 18 advisoriesRed Hat: 22 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Python Software FoundationCPythonbefore 3.10.22; 3.11.0 to before 3.11.17; 3.12.0 to before 3.12.15; 3.13.0 to before 3.13.16; 3.14.0 to before 3.14.8; 3.15.0a1 to before 3.15.0rc33.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8, 3.15.0rc3Patch availableCNA
  • CPython VendorPython Software Foundation Affected before 3.10.22; 3.11.0 to before 3.11.17; 3.12.0 to before 3.12.15; 3.13.0 to before 3.13.16; 3.14.0 to before 3.14.8; 3.15.0a1 to before 3.15.0rc3 Fixed in 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8, 3.15.0rc3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*——python-pillow
  • cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions — — ·python-pillow

Remediation

  • Fix · CNA CPython (Python Software Foundation) Fixed in 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8, 3.15.0rc3

Red Hat 18 advisories

  • RHSA-2026:95082 Released 2026-11-04 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) platform-python-3.6.8-39.el8_4.13, platform-python-debug-3.6.8-39.el8_4.13, platform-python-devel-3.6.8-39.el8_4.13 +3
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.13, platform-python-debug-3.6.8-39.el8_4.13, platform-python-devel-3.6.8-39.el8_4.13 +3
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) platform-python-3.6.8-39.el8_4.13, python3-3.6.8-39.el8_4.13, python3-libs-3.6.8-39.el8_4.13 +1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.13, python3-3.6.8-39.el8_4.13, python3-libs-3.6.8-39.el8_4.13 +1
  • RHSA-2026:94802 Released 2026-11-04 · Red Hat rating Critical
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:94443 Released 2026-11-03 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) platform-python-3.6.8-47.el8_6.16, platform-python-debug-3.6.8-47.el8_6.16, platform-python-devel-3.6.8-47.el8_6.16 +3
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) platform-python-3.6.8-47.el8_6.16, platform-python-debug-3.6.8-47.el8_6.16, platform-python-devel-3.6.8-47.el8_6.16 +3
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) platform-python-3.6.8-47.el8_6.16, python3-3.6.8-47.el8_6.16, python3-libs-3.6.8-47.el8_6.16 +1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) platform-python-3.6.8-47.el8_6.16, python3-3.6.8-47.el8_6.16, python3-libs-3.6.8-47.el8_6.16 +1
Show 15 more Red Hat advisories
  • RHSA-2026:89742 Released 2026-10-26 · Red Hat rating Important
    python3.9 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.25-7.el9_8.6, python3-devel-3.9.25-7.el9_8.6, python3-tkinter-3.9.25-7.el9_8.6
    • Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.25-7.el9_8.6, python3-libs-3.9.25-7.el9_8.6, python3.9-3.9.25-7.el9_8.6
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3-3.9.25-7.el9_8.6, python3-debug-3.9.25-7.el9_8.6, python3-idle-3.9.25-7.el9_8.6 +2
  • RHSA-2026:88200 Released 2026-10-22 · Red Hat rating Critical
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
  • RHSA-2026:87400 Released 2026-10-21 · Red Hat rating Important
    Red Hat Cost Management On-Premise container image update
    • Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10
  • RHSA-2026:85239 Released 2026-10-19 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-79.el8_10, platform-python-debug-3.6.8-79.el8_10, platform-python-devel-3.6.8-79.el8_10 +3
    • Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-79.el8_10, python3-3.6.8-79.el8_10, python3-libs-3.6.8-79.el8_10 +1
  • RHSA-2026:82939 Released 2026-10-14 · Red Hat rating Important
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:77020 Released 2026-10-08 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python-unversioned-command-3.12.15-1.el10_2, python3-devel-3.12.15-1.el10_2, python3-tkinter-3.12.15-1.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) python3-3.12.15-1.el10_2, python3-libs-3.12.15-1.el10_2, python3.12-3.12.15-1.el10_2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-debug-3.12.15-1.el10_2, python3-idle-3.12.15-1.el10_2, python3-test-3.12.15-1.el10_2
  • RHSA-2026:77017 Released 2026-10-08 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-3.12.15-1.el9_8, python3.12-devel-3.12.15-1.el9_8, python3.12-libs-3.12.15-1.el9_8 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.12-3.12.15-1.el9_8, python3.12-debug-3.12.15-1.el9_8, python3.12-idle-3.12.15-1.el9_8 +2
  • RHSA-2026:77018 Released 2026-10-08 · Red Hat rating Important
    python3.14 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python3.14-3.14.8-1.el10_2, python3.14-devel-3.14.8-1.el10_2, python3.14-libs-3.14.8-1.el10_2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3.14-debug-3.14.8-1.el10_2, python3.14-freethreading-3.14.8-1.el10_2, python3.14-freethreading-debug-3.14.8-1.el10_2 +7
  • RHSA-2026:77021 Released 2026-10-08 · Red Hat rating Important
    python3.14 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.14-3.14.8-1.el9_8, python3.14-devel-3.14.8-1.el9_8, python3.14-libs-3.14.8-1.el9_8 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.14-3.14.8-1.el9_8, python3.14-debug-3.14.8-1.el9_8, python3.14-freethreading-3.14.8-1.el9_8 +9
  • RHSA-2026:77028 Released 2026-10-07 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-3.12.15-2.el8_10, python3.12-devel-3.12.15-2.el8_10, python3.12-libs-3.12.15-2.el8_10 +2
    • Red Hat Enterprise Linux CRB (v. 8) python3.12-3.12.15-2.el8_10, python3.12-debug-3.12.15-2.el8_10, python3.12-idle-3.12.15-2.el8_10 +2
  • RHSA-2026:74606 Released 2026-10-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python3.12-3.12.14-1.4.hum1@aarch64, python3.12-3.12.14-1.4.hum1@src, python3.12-3.12.14-1.4.hum1@x86_64 +12
  • RHSA-2026:74605 Released 2026-10-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python3.13-3.13.15-1.4.hum1@aarch64, python3.13-3.13.15-1.4.hum1@src, python3.13-3.13.15-1.4.hum1@x86_64 +16
  • RHSA-2026:74599 Released 2026-10-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python3.11-3.11.16-1.5.hum1@aarch64, python3.11-3.11.16-1.5.hum1@src, python3.11-3.11.16-1.5.hum1@x86_64 +12
  • RHSA-2026:74594 Released 2026-10-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python3.10-3.10.21-1.5.hum1@aarch64, python3.10-3.10.21-1.5.hum1@src, python3.10-3.10.21-1.5.hum1@x86_64 +12
  • RHSA-2026:74587 Released 2026-10-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images python-unversioned-command-3.14.7-1.3.hum1@noarch@public-hummingbird-aarch64-rpms, python-unversioned-command-3.14.7-1.3.hum1@noarch@public-hummingbird-x86_64-rpms, python3-3.14.7-1.3.hum1@aarch64 +28

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Python Software Foundation CPython 3.10.22, 3.11.17 and 4 more versions

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-15850 Use-after-free of a server-side SSLContext when sni_callback switches contextsPriority MEDIUM 40
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)Affected—
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:88200
Red Hat Cost Management On-Premise 1Fixed RHSA-2026:87400
Red Hat Discovery 2Fixed RHSA-2026:94802
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:77018, RHSA-2026:77020
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:77028, RHSA-2026:85239
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:77017, RHSA-2026:77021, RHSA-2026:89742
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:95082
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:94443
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:95082
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:94443
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:77020
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:85239
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:89742
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:95082
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:94443
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:95082
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:94443
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:77028
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:77018, RHSA-2026:77020
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:77017, RHSA-2026:77021, RHSA-2026:89742
Red Hat Hardened ImagesFixed RHSA-2026:74587, RHSA-2026:74594, RHSA-2026:74599, RHSA-2026:74605, RHSA-2026:74606
Red Hat Update Infrastructure 5Fixed RHSA-2026:82939
Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19553
  2. 2026-10-03 Alias added: GHSA-xx9w-qm94-hghj
  3. 2026-10-07 Fix available: RHSA-2026:77028 · Red Hat
  4. 2026-10-07 Fix available: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · Red Hat
  5. 2026-10-08 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) +1 · Red Hat
  6. 2026-10-09 Fix available: RHSA-2026:77021 · Red Hat
  7. 2026-10-09 Fix available: RHSA-2026:77018 · Red Hat
  8. 2026-10-09 Fix available: RHSA-2026:77017 · Red Hat
  9. 2026-10-09 Fix available: RHSA-2026:77020 · Red Hat
  10. 2026-10-09 Fix available: Red Hat Enterprise Linux BaseOS (v. 10) · Red Hat
  11. 2026-10-10 Affected versions changed · Red Hat
  12. 2026-10-16 Fix available: RHSA-2026:82939 · Red Hat
  13. 2026-10-16 Fix available: Red Hat Update Infrastructure 5 · Red Hat
  14. 2026-10-16 CISA SSVC decision points changed
  15. 2026-10-20 Fix available: RHSA-2026:85239 · Red Hat
  16. 2026-10-20 Fix available: Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat
  17. 2026-10-22 Fix available: RHSA-2026:87400 · Red Hat
  18. 2026-10-23 Fix available: RHSA-2026:88200 · Red Hat
  19. 2026-10-23 Fix available: Red Hat Ansible Automation Platform 2.2, Red Hat Cost Management On-Premise 1 · Red Hat
  20. 2026-10-26 Fix available: RHSA-2026:89742 · Red Hat
  21. 2026-10-26 Fix available: Red Hat Enterprise Linux BaseOS (v. 9) · Red Hat
  22. 2026-10-30 Affected versions changed · Red Hat
  23. 2026-11-03 Fix available: RHSA-2026:94443 · Red Hat
  24. 2026-11-03 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6), Red Hat Enterprise Linux BaseOS AUS (v.8.6) +1 · Red Hat
  25. 2026-11-04 Fix available: RHSA-2026:94802 · Red Hat
  26. 2026-11-04 Fix available: Red Hat Discovery 2 · Red Hat
  27. 2026-11-04 Fix available: RHSA-2026:95082 · Red Hat
  28. 2026-11-04 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4), Red Hat Enterprise Linux BaseOS AUS (v.8.4) +1 · Red Hat
  29. 2026-11-06 Affected versions changed · Red Hat

References

Patch 8

Advisory 1

Other 1

  • TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
  • TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
  • TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
  • TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
  • TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
  • TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences