---
title: "CVE-2026-115557: Distrust compromised intermediate certificates in ssl module"
url: https://erroneo.us/security/cve/CVE-2026-115557/
description: "CVE-2026-115557 (Python Software Foundation CPython): Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-10-24
date_modified: 2026-10-25
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-115557"
kev: false
cvss: 9.4
epss: null
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-115557: Distrust compromised intermediate certificates in ssl module

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog. That can change quickly after a public write-up; re-check if you are affected.
- Editorial verdict: Patch this week. eMudhra CA Key Compromise: Update Non-Browser TLS Clients — Anyone can mint certificates from these broken CA keys, but only clients that skip Certificate Transparency and still trust the emSign root are exposed, and only to an on-path attacker: update those trust bundles this week, build machines first.

## What it is

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

## Affected products (CVE record)

- Python Software Foundation CPython: < 3.16.0

## Severity

- PSF CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).

## Sources

- [github.com](https://github.com/python/cpython/pull/160042)
- [mail.python.org](https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/)
- [github.com](https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d)
- [github.com](https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd)
- [github.com](https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93)
- [github.com](https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6)
- [github.com](https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5)
- [github.com](https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b)
- [github.com](https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90)
- [github.com](https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8)
- [github.com](https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78)
- [github.com](https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370)
- [github.com](https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e)
- [github.com](https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3)
- [CVE.org record CVE-2026-115557](https://www.cve.org/CVERecord?id=CVE-2026-115557)
- [NVD entry CVE-2026-115557](https://nvd.nist.gov/vuln/detail/CVE-2026-115557)
- [openwall.com](http://www.openwall.com/lists/oss-security/2026/10/20/29)
- [github.com](https://github.com/python/cpython/issues/160040)
- [emudhra.we-have-a-problem.com](https://emudhra.we-have-a-problem.com/)
- [openwall.com](http://www.openwall.com/lists/oss-security/2026/10/24/5)

---
Source page: https://erroneo.us/security/cve/CVE-2026-115557/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt