Critical Security Flaw in Python 3.14: Certificate Verification Bypass and Use-After-Free Vulnerabilities
Summary
RLSA-2026:77018: Important: python3.14 security update. Affects python3.14 versions < 0:3.14.8-1.el10_2. Fixed in 0:3.14.8-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.14 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries that facilitate rapid application development. However, recent vulnerabilities have been discovered that could compromise the security of applications utilizing this version.
Vulnerability Detail
The vulnerabilities in Python 3.14 stem from two critical issues: a certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio(), and a use-after-free condition of a server-side SSLContext when the sni_callback switches contexts. These vulnerabilities can lead to unauthorized access and data exposure, posing significant risks to applications relying on secure communications.
How To Fix
Minimum fixed version
0:3.14.8-1.el10_2
This is the first release that contains the fix.
sudo dnf update python3.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for these vulnerabilities. The best course of action is to apply the available patch as soon as possible.
Conclusion
The vulnerabilities in Python 3.14 present significant security risks that can compromise applications relying on this version. It is imperative to update to the latest patched version to ensure the integrity and security of your applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.14 →
FAQ
The main vulnerabilities are a certificate verification bypass and a use-after-free condition in SSLContext, which can lead to security breaches.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
Yes, a patch is available in version 3.14.8-1.el10_2 of Python 3.14.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.14.
