CVE-2026-119170High· 8.2▾ TwilightThere was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.
CPython >= 3.14.10 < 3.14.11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116566Medium· 5.3socket.getaddrinfo() accepts embedded null bytes in host and port
CVE-2024-9287Medium· 5.3Virtual environment (venv) activation scripts don't quote paths
CVE-2026-103995Low· 2.0Lenient parsing of integers for response body and chunk framing
CVE-2026-115557Critical· 9.4Distrust compromised intermediate certificates in ssl module
CVE-2026-114583Medium· 6.9tar filter allows writing outside destination via empty-named symlink
CVE-2024-3220Low· 2.3There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime …