---
id: CVE-2026-119170
title: >-
  Regression in FIPS enforcement of hash algorithms affecting only Python
  3.14.10
summary: >-
  There was a regression in how FIPS algorithms were enforced for the hashlib
  module. Only users that are using OpenSSL in FIPS mode are affected. Only
  Python 3.14.10 is affected, all other Python versions are unaffected.
severity: high
cvss: 8.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
vendor: Python Software Foundation
product: CPython
affected:
  - CPython >= 3.14.10 < 3.14.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T17:23:05.321707Z'
published: '2026-11-06'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T00:09:59.293Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119170'
references:
  - url: 'https://github.com/python/cpython/issues/160923'
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/
  - url: 'https://github.com/python/cpython/pull/160984'
tags:
  - cve.org
ingestedAt: '2026-11-06T15:54:04.095Z'
epss: 0.00488
epssPercentile: 0.42239
---

## Overview

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.

## Affected

- `CPython >= 3.14.10 < 3.14.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.