CVE-2026-115557

UNKNOWN

Published 2026-10-24 · Updated 2026-10-24 · Source cna@python.org

Description

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

CWE-299

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-114629
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation. An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.
2026-10-24 · score —
CVE-2026-110814
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
2026-10-23 · score —
CVE-2026-108793
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
2026-10-23 · score —
CVE-2026-108537
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
2026-10-23 · score —
CVE-2026-115897
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.
2026-10-23 · score —