Python: CPython FIPS enforcement regression (CVE-2026-119170)
A high-severity regression in CPython 3.14.10 fails to enforce mandatory FIPS-compliant hash algorithm restrictions, allowing the use of prohibited algorithms in sensitive environments.
CVE search metadata
CVE search record: CVE-2026-119170. KEV: no. Product: CPython (3.14.10). Brief: Python: CPython FIPS enforcement regression (CVE-2026-119170). Brief link: https://feed.craftedsignal.io/briefs/2026-11-python-fips-regression/
Triage facts
Revision 1- Applicability
- CPython (3.14.10)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 23:27 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CPython version 3.14.10 contains a regression that prevents the correct enforcement of FIPS-compliant hash algorithm restrictions. This vulnerability may result in the use of non-FIPS compliant algorithms in environments where such security policies are strictly required. The vulnerability is confirmed to affect only version 3.14.10.
Impact
Organizations operating in environments requiring strict FIPS compliance may inadvertently utilize prohibited hashing algorithms, potentially violating regulatory or security mandates.
Recommendation
- Upgrade all instances of CPython 3.14.10 to the next available secure version released by the Python Software Foundation.
- Audit environments where FIPS mode is enabled and CPython 3.14.10 is deployed to identify potential unauthorized use of legacy hash algorithms.
Immediate actions
Identify and upgrade all CPython 3.14.10 installations
Threat Hunt
Identify systems utilizing CPython 3.14.10 in FIPS-enabled environments
Data: Software inventory management data, Operating system environment variables (OPENSSL_FIPS)
Mitigations
Upgrade to non-vulnerable Python version
CVE-2026-119170