Python: five flaws in hashlib FIPS, http.cookiejar, ssl, imaplib and CLI tools (CVE-2026-119170, CVE-2026-124249), no fixed release yet
CVE-2026-115559 CVE-2026-115791 CVE-2026-119170 CVE-2026-124249 CVE-2026-19552
Published 11/11/2026 20:12
Timeline
3 events over 4 d 21 h
- 06/11/2026 22:41First report+3 d 15 h
- 10/11/2026 14:03CorroboratedBSI CERT-Bund (WID)+1 d 6 h
- 11/11/2026 20:12Published on WatchtowerPro CISO
In short
Five Python (CPython) flaws have been announced by the Python Software Foundation on its security-announce list. BSI CERT-Bund (the German CERT) has issued warnings about CPython and Python for several of them. CVE-2026-119170: a FIPS regression in hashlib that affects only Python 3.14.10 (CVSS 4.0 8.2, HIGH).
How bad is it
Medium. An attacker could delete cookies for other sites, impersonate a server in code using ssl.get_server_certificate with ca_certs, or inject plaintext into an IMAP STARTTLS session.
No exploitation reported yet.
Severity score
The worst of 5 CVEs · CVSS 4.0 from NVD, from python.org, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Change or delete that data
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- CVE-2026-119170: only Python 3.14.10 is affected (CVE record range from 3.14.10 before 3.14.11), and only where OpenSSL runs in FIPS mode.
- CVE-2026-124249: CVE record says affected from 0 before 3.16.0 (http.cookiejar). Applications that use one shared cookie jar for several sites are exposed.
- CVE-2026-19552: CVE record says affected before 3.16.0. Code that calls ssl.get_server_certificate() with ca_certs is exposed.
What to do now
- No fixed release is confirmed for any of the three flaws; check python.org for new releases before telling customers a fix exists.
- CVE-2026-119170: find hosts running exactly Python 3.14.10 with OpenSSL in FIPS mode, and plan to move to 3.14.11 once it is released.
- CVE-2026-124249 and CVE-2026-19552: update to the Python releases that carry the backported fixes once they are published.
- Interim measures: use a separate CookieJar per site or trust level, and use ssl.create_default_context() with check_hostname and server_hostname instead of ssl.get_server_certificate() with ca_certs. These measures reduce exposure and do not make a server safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 11 sources with their dates. And technology matching: which of your systems run Python, at which version, fixed or not - and what each one needs.
Main sources
[NEU] [mittel] Python: Schwachstelle ermöglicht Manipulation von Dateien CERT · [UPDATE] [mittel] Python: Schwachstelle ermöglicht Darstellen falscher Informationen CERT · [NEU] [mittel] CPython: Mehrere Schwachstellen CERT