The Morning Dev

Only the news worth knowing

‹
 
A65/100

Vulnerability · high · CVSS 8.2

Python 3.14.10 FIPS hash algorithm enforcement regression (CVE-2026-119170)

Tier A · Patch today – Before you go home

Who’s exposed: Python 3.14.10 users relying on FIPS hash algorithm enforcement

Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover

Reach

Attack

Damage

Fix

Popular tool · Remote, no login · Full takeover

The Brief

  • A regression in Python 3.14.10 breaks FIPS enforcement of hash algorithms, tracked as CVE-2026-119170.
  • The regression affects only Python 3.14.10, according to the oss-security post forwarding the Python security announcement.
  • The issue was announced on the Python security announce list on 2026-11-06.

Why it matters

Developers running Python 3.14.10 in FIPS-regulated environments may find that hash algorithms are not restricted as FIPS requires, which can affect compliance.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsPython is a language runtime developers build and run software with, so it falls under developer tools.
NoCore infrastructurePython 3.14.10 is a language runtime, not core infrastructure like OpenSSH, the Linux kernel or OpenSSL.
YesPopular toolPython is a widely used mainstream developer platform and language runtime.
NoExploited in the wildOss-security post (Coopersmith, Nov 06) describes a regression; it reports no observed attacks.
NoPublic exploitOss-security post describes a regression advisory; it reports no published exploit or PoC.
YesRemote, no loginCVSSCVE-2026-119170: CVSS 8.2 – network, no privileges, no user interaction
YesFull takeoverCISA SSVCCISA rates the technical impact of CVE-2026-119170 as total
NoSecrets exposedOss-security post describes a FIPS hash enforcement regression; it reports no data theft or exposure.
NoSupply chainOss-security post describes a FIPS hash enforcement regression; it reports no compromised package or build pipeline.
NoNo fix yetOss-security post excerpt does not state that a fixed version is unavailable.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-119170 ↗CVSS 8.2 high AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

    Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

    Exploited
    Not in CISA’s exploited catalog
    Weakness
    CWE-693

    NVDGHSA-vq78-g94j-3ppp

Timeline

  1. Regression in FIPS hash algorithm enforcement announced on Python security announce list

  2. Open Source Security

    [oss-security][CVE-2026-119170] Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

Source

[oss-security][CVE-2026-119170] Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10 ↗ Open Source Security · 3h ago

First seen · 1 source · Full story page · How tiers are decided