Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Fix
Microsoft's update · Critical
- Release Notes — azl3 python3 3.12.14-2 on Azure Linux 3.0 · build 3.12.15-3
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28.
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 16
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-27 00:36
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-27 01:19
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-26 00:37
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-26 16:54
- StatusReceived → PublishedNVD modified 2026-10-26 00:37
- StatusPublished → ReceivedNVD modified 2026-10-26 01:17
- StatusReceived → PublishedNVD modified 2026-10-25 00:39
- References+12 references (now 18)NVD modified 2026-10-25 01:16
- StatusPublished → ReceivedNVD modified 2026-10-25 01:16
- StatusReceived → PublishedNVD modified 2026-10-24 18:07
- References+1 references (now 6)NVD modified 2026-10-24 18:16
- StatusPublished → ReceivedNVD modified 2026-10-24 18:16
- StatusReceived → PublishedNVD modified 2026-10-24 14:20
- StatusPublished → ReceivedNVD modified 2026-10-24 15:17
- CVSS9.4 (v4.0, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) → 9.4 (v4.0, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)NVD modified 2026-10-24 15:17
- First seenCVSS 9.4 · python software foundationNVD modified 2026-10-24 14:20
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 18
- http://www.openwall.com/lists/oss-security/2026/10/20/29
- https://emudhra.we-have-a-problem.com/
- https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d
- https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd
- https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93
- https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6
- https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5
- https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b
- https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90
- https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8
- https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78
- https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370
- https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e
- https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3
- https://github.com/python/cpython/issues/160040
- https://github.com/python/cpython/pull/160042
- https://mail.python.org/archives/list/[email protected]/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/
- http://www.openwall.com/lists/oss-security/2026/10/24/5