Critical Security Update for Python 3.12: Addressing SSL Vulnerabilities
Summary
ALSA-2026:77028: Important: python3.12 security update. Affects python3.12 versions < 3.12.15-2.el8_10. Fixed in 3.12.15-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features modules, classes, exceptions, and high-level dynamic data types, making it versatile for developers. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this version, particularly concerning SSL/TLS communications.
Vulnerability Detail
The vulnerabilities in Python 3.12 stem from two critical issues: a certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio(), and a use-after-free error in server-side SSLContext when the sni_callback switches contexts. These vulnerabilities can lead to unauthorized access and potential data breaches, making it imperative for users to address them promptly.
How To Fix
Minimum fixed version
3.12.15-2.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable SSL certificate verification in their applications, but this is not recommended as it exposes the application to security risks. Instead, users should prioritize updating to the patched version as soon as possible.
Conclusion
The vulnerabilities identified in Python 3.12 present significant security risks that must be addressed promptly. Users are strongly encouraged to update to the latest patched version to safeguard their applications against potential exploits. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for python3.12 →
FAQ
The vulnerabilities include a certificate verification bypass and a use-after-free error in SSLContext, which can lead to security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing temporary workarounds, such as disabling SSL verification, but be aware of the associated risks.
For detailed information, refer to the CVE pages: CVE-2026-19445 and CVE-2026-19553.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
