Critical Security Flaws in Python 3.14: Certificate Verification Bypass and Use-After-Free Vulnerabilities
Summary
RLSA-2026:77021: Important: python3.14 security update. Affects python3.14 versions < 0:3.14.8-1.el9_8. Fixed in 0:3.14.8-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.14 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries, making it a versatile choice for developers. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this version.
Vulnerability Detail
The vulnerabilities in Python 3.14 stem from two critical issues: a certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio(), and a use-after-free condition in server-side SSLContext when the sni_callback switches contexts. These vulnerabilities can lead to unauthorized access to sensitive data and potential exploitation by attackers, posing significant risks to applications utilizing this version of Python.
How To Fix
Minimum fixed version
0:3.14.8-1.el9_8
This is the first release that contains the fix.
sudo dnf update python3.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling SSL certificate verification in your application, although this is not recommended for production environments due to security risks. If you must implement this, you can modify your SSL context as follows: 'ssl_context.verify_mode = ssl.CERT_NONE'. However, this should only be a short-term solution until the package is updated.
Conclusion
The vulnerabilities in Python 3.14 present significant security risks that can affect applications relying on this version. It is crucial to update to the patched version 3.14.8-1.el9_8 to mitigate these risks. Additionally, using tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for python3.14 →
FAQ
The main vulnerabilities include a certificate verification bypass and a use-after-free condition in SSLContext, which can lead to security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of the vulnerabilities in Python 3.14 is 8.1, indicating a high severity level.
Yes, a patch is available in the form of Python version 3.14.8-1.el9_8, which addresses the identified vulnerabilities.
If you cannot update Python immediately, consider implementing temporary workarounds, such as disabling SSL certificate verification, but be aware of the associated security risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.14.
