CVE-2026-19553

{
  "etk_id": "ETK-2026-130",
  "cve_id": "CVE-2026-19553",
  "display_id": "CVE-2026-19553",
  "ghsa_id": "GHSA-xx9w-qm94-hghj",
  "euvd_id": "EUVD-2026-90078",
  "status": "published",
  "anchor_state": "anchored",
  "title": "TLS hostname verification bypass in CPython SSLObject",
  "summary": "CPython TLS clients using SSLObject-related connection APIs may fail to validate the peer certificate hostname. An attacker could exploit this to defeat intended server identity checks when the application enables hostname checking but does not provide a nonempty server hostname.",
  "mitigation": "Pass a valid, nonempty server hostname to SSLContext.wrap_bio(), asyncio.create_connection(), and asyncio.loop.start_tls() where applicable. Upgrade CPython to 3.16.0 so missing hostnames are rejected rather than silently bypassing verification.",
  "vendor": "Python Software Foundation",
  "product": "CPython",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.16.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.16.0"
      ],
      "package_name": "CPython",
      "purl": null
    }
  ],
  "cwes": [
    297
  ],
  "cvss_score": 7.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.004,
  "epss_percentile": 0.3295,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 12.436125933333333,
  "t0_at": "2026-09-30T16:17:39.368000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T06:42:39.782495+00:00",
      "days": 2.6006992418402777,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T16:17:39.368000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-02T01:46:32+00:00",
      "days": 1.3950536111111111,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T16:17:39.368000+00:00",
      "url": "https://github.com/abraxas/cve-2026-19553-wrap-bio"
    },
    "trigger_signal": {
      "at": "2026-09-30T16:17:39.368000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T16:17:39.368000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19553"
    }
  }
}