CPython SSLContext.wrap_bio() Hostname Verification Bypass (CVE-2026-19553)

The Python Security Response Team says SSLContext.wrap_bio() did not require the server_hostname argument to be set when SSLContext.check_hostname was set. A missing parameter check in SSLObject let hostname verification silently skip.

The advisory says this let a program's certificate hostname check appear to succeed with check_hostname=True, with no ValueError raised to flag the misconfiguration. SSLContext.wrap_socket(), the synchronous counterpart, already raised in this case. asyncio.create_connection() and asyncio.loop.start_tls() can turn an empty server_hostname into None and call wrap_bio(), inheriting the same silent skip.

What an Attacker Gains

The advisory describes the risk this way: a network position between the client and the intended server can present a certificate that is valid for a different hostname. Because verification is skipped, the handshake completes, and the client treats the connection as authenticated without confirming the peer's identity. We leave out request and reproduction detail on purpose.

The bug mainly reaches code that calls SSLContext.wrap_bio() directly, or that reaches it through asyncio's TLS connection and upgrade functions, without passing a real server_hostname. The CVE record and the advisory name no specific framework; any Python networking code built this way inherits the gap. See our Certificate Authority entry for how hostname checks fit into certificate trust.

Mitigating Without an Upgrade

The advisory says upgrading is not required to mitigate this flaw. Passing a valid server_hostname value, one that is not None and not an empty string, to SSLContext.wrap_bio(), asyncio.create_connection() or asyncio.loop.start_tls() restores hostname verification right away.

How the Score Reads

The Python Security Response Team, the CNA, scores it CVSS 4.0 7.6 High with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. NVD lists this score as secondary and shows the entry as Awaiting Analysis. There is no CVSS 3.1 score in the record or NVD. See our CVSS entry for how to read the vector.

What CISA and the Record Say About Exploitation

CISA's SSVC decision, recorded in the NVD entry and dated 16 October 2026, scores exploitation as none and rates the bug not automatable. As of CISA catalog version 2026.11.06, the CVE is not in the Known Exploited Vulnerabilities catalog.

The CVE record lists every maintained CPython 3.x branch as affected, each before its fixed build. The pre-release 3.15 branch is affected too, before its own fixed release candidate.

The fix changes behavior, not just code. After the patch, an omitted server_hostname raises a ValueError instead of silently skipping the check, matching how SSLContext.wrap_socket() already behaved. Teams should expect new ValueErrors right after upgrading and treat each one as a configuration bug to fix, not a transient failure.

The advisory credits devdanzin as the reporter, Bhuvansh as analyst, Bénédikt Tran as remediation reviewer and Seth Larson as coordinator. Our vulnerability management guide covers how to plan a dependency upgrade like this one.