Vulnerability · none · CVSS 0
CPython CVE-2026-19552: ssl.get_server_certificate skips identity check
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Code calling ssl.get_server_certificate with ca_certs
Tier B because: Core infrastructure or popular tool AND remote, no login
Reach
Attack
Damage
Fix
Popular tool · Remote, no login
The Brief
- CPython disclosed CVE-2026-19552 on 2026-11-09.
- ssl.get_server_certificate(addr, ca_certs=...) verifies the certificate chain but does not check the server's identity.
- The advisory was sent by Seth Larson to the Security-announce list and forwarded to oss-sec.
Why it matters
Code that relies on ssl.get_server_certificate with ca_certs to authenticate a server may accept a certificate that is valid for a different host but signed by a trusted CA.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: CPython is the Python runtime that developers build and run software with. |
| No | Core infrastructure | Judgment: a flaw in one language runtime's stdlib function is not core infrastructure like OpenSSH or glibc. |
| Yes | Popular tool | Judgment: CPython is a mainstream, widely used language runtime. |
| No | Exploited in the wild | Open Source Security: advisory describes a verification flaw; no observed attacks reported. |
| No | Public exploit | Open Source Security: advisory text only; no exploit code or PoC mentioned. |
| Yes | Remote, no login | CVSSCVE-2026-19552: CVSS 0 – network, no privileges, no user interaction |
| No | Full takeover | CVSSCVSS: no CVE has both high confidentiality and integrity impact |
| No | Secrets exposed | Open Source Security: advisory reports no stolen or exposed credentials, keys or data. |
| No | Supply chain | Open Source Security: normal verification bug in legitimate code; no malicious shipping reported. |
| No | No fix yet | Open Source Security: advisory does not state that a patched version is unavailable. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-19552 ↗CVSS 0 none AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed via Security-announce and posted to oss-sec
Open Source Security
CPython: [CVE-2026-19552] ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity
Source
CPython: [CVE-2026-19552] ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity ↗ Open Source Security · 3h ago
First seen · 1 source · Full story page · How tiers are decided