Critical Security Flaw in Python 3.12: Certificate Verification Bypass and Use-After-Free Vulnerability
Summary
RLSA-2026:77028: Important: python3.12 security update. Affects python3.12 versions < 0:3.12.15-2.el8_10. Fixed in 0:3.12.15-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and a rich set of libraries and modules. However, recent security vulnerabilities have been identified that could compromise the integrity of SSL connections, making it crucial for users to address these issues promptly.
Vulnerability Detail
The vulnerabilities in Python 3.12 stem from two main issues: a certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) and a use-after-free condition of a server-side SSLContext when the sni_callback switches contexts (CVE-2026-19445). These vulnerabilities can lead to unauthorized access to sensitive data, man-in-the-middle attacks, and potential system compromise, highlighting the importance of immediate remediation.
How To Fix
Minimum fixed version
0:3.12.15-2.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected SSLContext features until the update is applied. However, this is not a long-term solution, and updating to the patched version is strongly recommended.
Conclusion
The vulnerabilities identified in Python 3.12 pose significant security risks that can lead to unauthorized access and data breaches. It is essential for users to update to the latest patched version to mitigate these risks effectively. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include a certificate verification bypass and a use-after-free condition in SSLContext, which can lead to security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for these vulnerabilities is 8.1, indicating a high level of severity.
Yes, a patch is available in version 0:3.12.15-2.el8_10 of Python 3.12.
If you cannot update immediately, avoid using the affected SSLContext features as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
