# CPython: [CVE-2026-19552] ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/605) · 2026-11-09 · Security
Page: https://themorning.dev/story/cpython-cve-2026-19552-ssl-get-server-certificate-addr-ca-certs-verifies-the-cha-d2f20ea96a09325f
Kind: security · Impact: medium

## In brief

- CPython disclosed CVE-2026-19552 on 2026-11-09.
- ssl.get_server_certificate(addr, ca_certs=...) verifies the certificate chain but does not check the server's identity.
- The advisory was sent by Seth Larson to the Security-announce list and forwarded to oss-sec.

## Why it matters

Code that relies on ssl.get_server_certificate with ca_certs to authenticate a server may accept a certificate that is valid for a different host but signed by a trusted CA.

## CVEs

- CVE-2026-19552

## Timeline

- 2026-11-09: Vulnerability disclosed via Security-announce and posted to oss-sec

## Coverage

- [CPython: [CVE-2026-19552] ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity](https://seclists.org/oss-sec/2026/q4/605) — Open Source Security, 2026-11-09

Tags: python, security, tls, certificate-validation, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev