Is CVE-2026-19552 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19552 being exploited in the wild.

How severe is CVE-2026-19552?

Informational severity, published 9 November 2026.

Which products and versions are affected?

Python CPython 3.11, 3.12, 3.13, 3.14, 3.15, 3.16.

Is there a fix for CVE-2026-19552?

Yes: fixed in CPython 3.11 (via gh-161670), 3.12 (via gh-161671), 3.13, 3.14, 3.15, 3.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19552 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-19552?

Check whether you run Python CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19552: CPython ssl.get_server_certificate hostname verification bypass

CVE-2026-19552 · Severity: info · Published 2026-11-09

CPython's ssl.get_server_certificate() function, when supplied with custom root certificates, validates the certificate chain but fails to verify that the certificate actually belongs to the server being contacted. This allows an attacker with a valid certificate for any domain (issued by a trusted CA) to impersonate any server, enabling man-in-the-middle attacks and data interception on applications using this function.

Technologies: Python CPython. Vendors: Python.

Quick answers

Is CVE-2026-19552 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19552 being exploited in the wild.
How severe is CVE-2026-19552?: Informational severity, published 9 November 2026.
Which products and versions are affected?: Python CPython 3.11, 3.12, 3.13, 3.14, 3.15, 3.16.
Is there a fix for CVE-2026-19552?: Yes: fixed in CPython 3.11 (via gh-161670), 3.12 (via gh-161671), 3.13, 3.14, 3.15, 3.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19552 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-19552?: Check whether you run Python CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: CPython 3.11 (via gh-161670), 3.12 (via gh-161671), 3.13, 3.14, 3.15, 3.16

Technical details

The ssl.get_server_certificate() function performs X.509 chain validation against the supplied ca_certs but omits hostname verification, allowing presentation of any valid certificate regardless of identity. The vulnerability requires network access and application use of the function with custom ca_certs parameter. An attacker can intercept connections and present a valid certificate for a different hostname, which the function accepts as legitimate.

Affected products

Python CPython 3.11, 3.12, 3.13, 3.14, 3.15, 3.16

Timeline

2026-11-06: disclosed
2026-11-07: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.