--- id: CVE-2026-19553 title: |- ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set summary: |- ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname ve… severity: high cvss: 7.6 cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N' cwe: - CWE-297 - CWE-295 vendor: Python Software Foundation product: CPython affected: - CPython < 3.10.22 - CPython >= 3.11.0 < 3.11.17 - CPython >= 3.12.0 < 3.12.15 - CPython >= 3.13.0 < 3.13.16 - CPython >= 3.14.0 < 3.14.8 - CPython >= 3.15.0a1 < 3.15.0rc3 patched: - hardened_images published: '2026-09-30' updated: '2026-10-16' sourceUpdated: '2026-10-16T19:17:06.673' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19553' references: - url: >- https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96 label: cna@python.org - url: >- https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf label: cna@python.org - url: >- https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082 label: cna@python.org - url: >- https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed label: cna@python.org - url: >- https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced label: cna@python.org - url: >- https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80 label: cna@python.org - url: >- https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062 label: cna@python.org - url: 'https://github.com/python/cpython/issues/156793' label: cna@python.org - url: 'https://github.com/python/cpython/pull/158503' label: cna@python.org - url: >- https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/ label: cna@python.org - url: 'http://www.openwall.com/lists/oss-security/2026/09/30/16' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19553.json - url: 'https://access.redhat.com/security/cve/CVE-2026-19553' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2544127' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-19553' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19553' - url: 'https://access.redhat.com/errata/RHSA-2026:74587' - url: 'https://access.redhat.com/errata/RHSA-2026:74594' - url: 'https://access.redhat.com/errata/RHSA-2026:74599' - url: 'https://access.redhat.com/errata/RHSA-2026:74606' - url: 'https://access.redhat.com/errata/RHSA-2026:74605' - url: 'https://access.redhat.com/errata/RHSA-2026:77028' - url: 'https://access.redhat.com/errata/RHSA-2026:77020' - url: 'https://access.redhat.com/errata/RHSA-2026:77018' - url: 'https://access.redhat.com/errata/RHSA-2026:85239' - url: 'https://access.redhat.com/errata/RHSA-2026:77017' - url: 'https://access.redhat.com/errata/RHSA-2026:77021' - url: 'https://access.redhat.com/errata/RHSA-2026:88200' - url: 'https://access.redhat.com/errata/RHSA-2026:87400' - url: 'https://access.redhat.com/errata/RHSA-2026:82939' - url: 'https://access.redhat.com/errata/RHSA-2026:89742' tags: - nvd - exploit-available - cve.org - csaf - vex - red-hat epss: 0.00547 epssPercentile: 0.4562 exploits: github: 1 githubRepos: - 'https://github.com/abraxas/cve-2026-19553-wrap-bio' checkedAt: '2026-10-27T19:55:03.851Z' exploitAvailable: true ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-16T18:33:08.291056Z' cvssSource: cna scores: cna: 7.6 vendor: 7.4 ingestedAt: '2026-09-30T17:13:20.841Z' --- ## Overview ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift Virtualization 4 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Enterprise Linux 6, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19553.json) - **RHSA-2026:74587** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74587) - **RHSA-2026:74594** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74594) - **RHSA-2026:74599** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74599) - **RHSA-2026:74606** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74606) - **RHSA-2026:74605** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74605) - **RHSA-2026:77028** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-10-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:77028) - **RHSA-2026:77020** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77020) - **RHSA-2026:77018** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77018) - **RHSA-2026:85239** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85239) - **RHSA-2026:77017** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77017) - **RHSA-2026:77021** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77021) - **RHSA-2026:88200** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88200) - **RHSA-2026:87400** · Red Hat · fixed in: Red Hat Cost Management On-Premise 1 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87400) - **RHSA-2026:89742** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-10-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:89742)