CVE-2026-19553
Severity not reportedssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set.
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96 cna@python.org
- https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf cna@python.org
- https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082 cna@python.org
- https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed cna@python.org
- https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced cna@python.org
- https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80 cna@python.org
- https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062 cna@python.org
- https://github.com/python/cpython/issues/156793 cna@python.org
- https://github.com/python/cpython/pull/158503 cna@python.org
- https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMV... cna@python.org
- http://www.openwall.com/lists/oss-security/2026/09/30/16 af854a3a-2127-422b-91ae-364da2661108