Skip to content
High Severity Vulnerability in CPython SSLContext.wrap_bio() Discovered

High Severity Vulnerability in CPython SSLContext.wrap_bio() Discovered

First seen 10 Nov 2026, 21:50 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 21:51 UTC
  • •CVE-2026-19553 affects CPython's SSLContext.wrap_bio() method.
  • •Hostname verification can be silently skipped, posing a security risk.
  • •Mitigation is possible without upgrading by providing a valid server_hostname.

CVE-2026-19553 reveals a high severity vulnerability in CPython's SSLContext.wrap_bio() method, which failed to validate the server_hostname parameter when check_hostname was enabled. This flaw allows hostname verification to be silently skipped, potentially enabling attackers to exploit the vulnerability by presenting a valid certificate for a different hostname. The vulnerability affects all maintained CPython 3.x branches prior to their respective fixed versions. Mitigation does not require an upgrade; passing a valid server_hostname restores hostname verification. The Python Security Response Team has classified this vulnerability with a CVSS score of 7.6. As of October 16, 2026, CISA has assessed the exploitation risk as none, and it is not listed in the Known Exploited Vulnerabilities catalog. The fix changes the behavior of the method to raise a ValueError when server_hostname is omitted, aligning it with the behavior of SSLContext.wrap_socket().

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-30
CVE-2026-19553 published
The vulnerability in CPython's SSLContext.wrap_bio() was officially published, highlighting the missing validation of server_hostname.
Brandefense
2026-10-02
First public PoC released
Proof-of-concept code for CVE-2026-19553 was made publicly available, demonstrating the vulnerability's exploitation potential.
Brandefense
2026-11-10
Fix released
The Python Security Response Team released a fix for the vulnerability in multiple CPython versions, changing the behavior of SSLContext.wrap_bio().
mail.python.org

More articles in this cluster (4)

Following this threat?

Track CVE-2026-19553 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (1)

1 / 2

Common questions

What versions of CPython are affected?
All maintained CPython 3.x branches prior to their respective fixed versions are affected.
How can I mitigate this vulnerability?
You can mitigate the vulnerability by passing a valid, non-empty server_hostname value to the affected methods.
Is there an active exploit for this vulnerability?
No, CISA has assessed the exploitation risk as none, and it is not listed in the Known Exploited Vulnerabilities catalog.