CVE-2026-19553

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied.

• CWE-297

• https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96
• https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf
• https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082
• https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed
• https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced
• https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80
• https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062
• https://github.com/python/cpython/issues/156793
• https://github.com/python/cpython/pull/158503
• https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/
• https://www.openwall.com/lists/oss-security/2026/09/30/16

Published

Sep 30, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19542Calling tdelete on a sufficiently deep tree in the GNU C Lib…5.6
• CVE-2026-19543IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2…6.2
• CVE-2026-19546A flaw was found in DBI. This is a fix for a partial fix for…8.8
• CVE-2026-19547Ghostscript for Windows is vulnerable to local privilege esc…7
• CVE-2026-19548Multiple Use-After-Free vulnerabilities were found in the ad…5.5
• CVE-2026-19550A flaw was found in FreeIPA. The trust-fetch-domains command…8.2
• CVE-2026-19556Use after free in V8 in Google Chrome prior to 151.0.7922.13…8.8
• CVE-2026-19557Use after free in TabStrip in Google Chrome on Mac prior to …8.3
• CVE-2026-19558Use after free in Extensions in Google Chrome prior to 151.0…7.5
• CVE-2026-19559Use after free in HTML in Google Chrome prior to 151.0.7922.…8.8
• CVE-2026-19560Use after free in Blink in Google Chrome prior to 151.0.7922…8.8
• CVE-2026-19561Rejected reason: This CVE ID has been rejected or withdrawn …