Regression in FIPS enforcement of hash algorithms in CPython hashlib
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-693.
Summary
CPython from 3.14.10 before 3.14.11 has a regression in how the hashlib module enforces FIPS algorithms. Only users running OpenSSL in FIPS mode are affected, and other Python versions are unaffected. The CVSS vector rates it as remotely exploitable without privileges or user interaction, with high integrity impact.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Python Software Foundation | CPython | 3.14.10 to before 3.14.11 | 3.14.11 | Patch available | CNA |
- CPython VendorPython Software Foundation Affected 3.14.10 to before 3.14.11 Fixed in 3.14.11 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | — | — | python-pillow |
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions — — ·python-pillow
Remediation
Upgrade CPython to 3.14.11.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA CPython (Python Software Foundation) Fixed in 3.14.11
Timeline
- 2026-11-06 Threatist record created from CVE-2026-119170
- 2026-11-06 Alias added: GHSA-vq78-g94j-3ppp
- 2026-11-06 Weakness changed · CISA ADP
- 2026-11-06 CISA SSVC decision points changed
- 2026-11-06 Priority changed: MEDIUM → LOW
References
More Python Software Foundation vulnerabilities
- TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
- TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
- TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
- TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
- TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
- TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
Sources
- CVE-2026-119170 · CVE Program
- CVE-2026-119170 · NVD
- FIRST EPSS
- GHSA-vq78-g94j-3ppp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences