Critical Security Flaw in Python 3.14: Certificate Verification Bypass and Use-After-Free Vulnerabilities
Summary
ALSA-2026:77018: Important: python3.14 security update. Affects python3.14 versions < 3.14.8-1.el10_2. Fixed in 3.14.8-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.14 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries, making it a popular choice among developers. However, recent vulnerabilities have been identified that could compromise the security of applications using this version.
Vulnerability Detail
The vulnerabilities in Python 3.14 stem from two critical issues: a certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio(), and a use-after-free vulnerability of a server-side SSLContext when the sni_callback switches contexts. These vulnerabilities can lead to unauthorized access and data exposure, potentially allowing attackers to intercept secure communications.
How To Fix
Minimum fixed version
3.14.8-1.el10_2
This is the first release that contains the fix.
sudo dnf update python3.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling SSL verification in your application. However, this is not recommended for production environments due to security risks. If you must implement this, you can do so by setting the verify parameter to False in your SSL context configuration.
Conclusion
The vulnerabilities in Python 3.14 pose significant security risks that can compromise applications relying on this version. It is crucial to update to the patched version 3.14.8-1.el10_2 to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for python3.14 →
FAQ
The main vulnerabilities include a certificate verification bypass and a use-after-free issue in SSLContext.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider implementing workarounds such as disabling SSL verification, but be aware of the associated risks.
Yes, several related packages such as python3.14-debug, python3.14-devel, and others are also affected and should be updated.
These vulnerabilities can lead to unauthorized access and data exposure, potentially allowing attackers to intercept secure communications.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14.
