SecurityFan score 43 · Tier B
CPython: [CVE-2026-19552] ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity
The Brief
- CPython disclosed CVE-2026-19552 on 2026-11-09.
- ssl.get_server_certificate(addr, ca_certs=...) verifies the certificate chain but does not check the server's identity.
- The advisory was sent by Seth Larson to the Security-announce list and forwarded to oss-sec.
Why it matters
Code that relies on ssl.get_server_certificate with ca_certs to authenticate a server may accept a certificate that is valid for a different host but signed by a trusted CA.
Who’s affected
- Python applications calling ssl.get_server_certificate with ca_certs
Posted by Alan Coopersmith on Nov 09 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-19552] ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity Date: Mon, 9 Nov 2026 14:12:16 +0000 From: Seth Larson <seth () python…
Timeline
Vulnerability disclosed via Security-announce and posted to oss-sec
Open Source Security
CPython: [CVE-2026-19552] ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity