low
advisory
CPython: ssl.get_server_certificate fails identity verification (CVE-2026-19552)
CPython vulnerability CVE-2026-19552 affects ssl.get_server_certificate(addr, ca_certs=...), which verifies the certificate chain but does not verify the identity.
CVE search metadata
CVE search record: CVE-2026-19552. KEV: no. Product: CPython. Brief: CPython: ssl.get_server_certificate fails identity verification (CVE-2026-19552). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cpython-ssl-verification/
Triage facts
Revision 1- Applicability
- CPython
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 21:17 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Unknown
The Python Software Foundation has announced a low-severity vulnerability in CPython (CVE-2026-19552). When the ca_certs parameter is supplied to ssl.get_server_certificate, the function verifies the certificate chain but fails to verify the identity.