CVE-2026-115557

What it actually does

The ssl module previously permitted connections to servers presenting known-compromised certificates when certificate revocation checking was not explicitly enabled in the SSLContext.

Why it matters to the business

Organizations relying on Python applications for secure network communication face elevated risk of undetected use of stolen or fraudulent certificates, potentially leading to data interception or unauthorized access until the denylist is deployed.

How an attack unfolds

An attacker presents a certificate known to have been compromised; because the ssl module honors the application's SSLContext revocation policy, the connection succeeds and encrypted traffic can be decrypted or impersonated.

How to fix it

Upgrade to a Python release that includes the built-in denylist for compromised certificates; alternatively, enforce certificate revocation checking in all SSLContext instances and maintain an up-to-date local revocation store.

How to confirm the fix worked

After upgrade, attempt a TLS connection to a test endpoint that presents a known-compromised certificate and confirm the connection is rejected with an appropriate ssl.SSLError regardless of the verify_flags setting.

Typical attack path

1. Identify a Python application performing TLS connections without mandatory revocation checking.
2. Obtain or forge a certificate from the set of known-compromised certificates.
3. Position a network interceptor or rogue server that presents the certificate during the TLS handshake.
4. Establish a decrypted session with the victim application and exfiltrate or manipulate traffic.

How to detect it

Review application and system logs for successful TLS handshakes that later show certificate anomalies; search for Python processes establishing outbound connections to hosts whose certificates match entries on public compromised-certificate lists.

What your security team should do

• Prioritize patching all Python runtimes used for outbound TLS within the next 30 days.
• Audit codebases for explicit creation of SSLContext objects and ensure revocation is enabled where the denylist cannot yet be applied.
• Add the new certificate denylist behavior to security regression test suites.