> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CPython security policy bypass vulnerabilities CVE-2026-114583 and CVE-2026-115557 require urgent… - URL: https://f4n6.co.uk/security-feed/cpython-security-policy-bypass-vulnerabilities-cve-2026-114583-and-cve-2026-115557-require-urgent/ - Published: 2026-10-26T18:36:53.000Z - Updated: 2026-10-26T18:36:53.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-114583, CVE-2026-115557 ## 1\. Executive summary The French national CERT (CERT-FR) published advisory CERTFR-2026-AVI-1379 on 26 October 2026 covering two vulnerabilities in CPython that allow an attacker to bypass the security policy. CVE-2026-115557 carries a CVSS of 9.4 (CRITICAL) and is classified CWE-299 (improper check for certificate revocation); CVE-2026-114583 carries a CVSS of 6.9 (MEDIUM). Neither is listed in CISA KEV, and EPSS is 0% for CVE-2026-114583 and 1% for CVE-2026-115557, so there is no evidence of exploitation in the wild at the time of writing. The exposure for EMEA financial services is not the CPython interpreter as an end-user product but the embedded interpreter inside application servers, CI/CD runners, data pipelines and third-party appliances, where a security-policy bypass in the runtime can undermine TLS trust decisions or sandbox assumptions that downstream controls depend on. The CERT-FR bulletin gives no technical mechanism, no affected version ranges and no fixed versions; the two Python security-announce threads it cites are the only route to that detail and were not available for this note. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | The flaw sits in CPython, a third-party software component embedded across the estate, and the CERT-FR bulletin names no fixed version, so remediation depends on tracking the upstream Python security-announce threads and each vendor's rebuild. | Third-party risk records for any product shipping an affected CPython build need the upstream fix status confirmed with the supplier, not assumed from the CERT-FR advisory alone. | | NIS2 Art. 21(2)(d) | Same fact: a supply chain component (the Python runtime) with an unresolved fix state at the time of the bulletin. | Entities in scope must be able to show they track and apply security updates for embedded runtime components supplied by third parties. | No DORA incident-reporting article is engaged: nothing in this item describes an incident at a client, and neither CVE is in CISA KEV or shows exploitation. ## 3\. Technical analysis & attack chain CERT-FR classifies both issues under a single risk heading, "contournement de la politique de sécurité" (security policy bypass). It does not describe the mechanism, the affected CPython versions, the attack vector, or the fixed release. The two Python security-announce threads cited (43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK, dated 22 October 2026, and FNAJMZV6XQYLVPABNINDMF3VF66AYLW4, dated 24 October 2026) are where that detail would sit; they are not reproduced in the source material and this advisory does not infer their contents. What the verified data establishes: 1. CVE-2026-115557 is rated CVSS 9.4 CRITICAL and mapped to CWE-299, improper check for certificate revocation. A revocation-check weakness in a TLS stack means a certificate that has been revoked can still be accepted, which defeats the purpose of revocation as a trust control. That is consistent with the CERT-FR "security policy bypass" label, but the mapping to a specific CPython component (for example `ssl`, `_ssl`, or the underlying OpenSSL binding) is not stated in the source and should not be assumed. 2. CVE-2026-114583 is rated CVSS 6.9 MEDIUM. No CWE is recorded for it in the verified data and the source gives no further description. 3. Neither CVE is in CISA KEV. EPSS is 0% for CVE-2026-114583 and 1% for CVE-2026-115557\. These are point-in-time probability estimates, not a statement that exploitation is impossible. No attack chain can be written from confirmed steps. The source does not describe initial access, a payload, persistence, privilege escalation, command-and-control, lateral movement or data access for either CVE. Any narrative of "an attacker sends a crafted request to trigger the bypass" would be invented, and is omitted. Confidence caveat: the entire technical basis for this advisory is a single CERT-FR bulletin that itself defers to two upstream Python threads. The severity and CWE values come from NVD. No independent vendor analysis, proof-of-concept, or exploitation report was available. Treat the mechanism as unknown until the Python security-announce threads are read. ## 4\. Mitigation & containment The source gives no vendor fix version and no configuration guidance beyond "refer to the publisher's security bulletin". The concrete actions below follow from that gap. ### P1, within 24 hours - Read both Python security-announce threads (43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK and FNAJMZV6XQYLVPABNINDMF3VF66AYLW4) and record the affected version ranges and the fixed CPython releases for CVE-2026-114583 and CVE-2026-115557\. Until that is done the estate cannot be scoped. - Inventory every CPython runtime in the estate: `python3 --version` and `python3 -c "import sys; print(sys.version)"` on hosts and build images, plus the interpreter bundled inside application servers, container base images, CI runners and third-party appliances. The affected set is "CPython without the latest security patch", so the inventory is the control. - For any internet-facing service whose TLS trust depends on the embedded CPython `ssl` module, treat CVE-2026-115557 as the priority: a revocation-check bypass (CWE-299) means a revoked certificate may still be accepted. Where the fixed release is not yet available, enforce revocation at the terminator or proxy in front of the Python service rather than relying on the interpreter. ### P2, within 72 hours - Patch or pin CPython to the fixed releases named in the Python threads once identified. For container images, rebuild from an updated base rather than patching in place, and pin the base image digest. - Raise a supplier query for every third-party product that embeds CPython, asking for its rebuild status against CVE-2026-114583 and CVE-2026-115557\. Record the response against the DORA Art. 28 third-party risk entry. ### P3, within 7 days - Add CPython version drift to the vulnerability management baseline so embedded interpreters are scanned, not just OS packages. - Where a Python service makes certificate-trust decisions, add a test that a revoked certificate is rejected, so the control is verified rather than assumed. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The CERT-FR bulletin lists no hashes, domains, IP addresses, file paths or command lines, and neither CVE is in CISA KEV. ## 6\. Detection Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, file names, registry keys or network artefacts attributable to the vulnerabilities. The only usable detection primitive is version-based: flag any CPython interpreter below the fixed release once that release is confirmed from the Python security-announce threads. ## CVE assessment 2 referenced CVEs — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | --------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-115557](https://nvd.nist.gov/vuln/detail/CVE-2026-115557?ref=f4n6.co.uk) | 9.4 Critical | — | 1% | Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certifica… | | [CVE-2026-114583](https://nvd.nist.gov/vuln/detail/CVE-2026-114583?ref=f4n6.co.uk) | 6.9 Medium | — | 0% | tarfile.tar\_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redi… | ## 7\. Sources - ANSSI / CERT-FR, "Multiples vulnérabilités dans CPython" (CERTFR-2026-AVI-1379), 26 October 2026\. https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1379/ - Python security-announce thread 43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK, 22 October 2026 (cited by CERT-FR; not reviewed for this note). https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/ - Python security-announce thread FNAJMZV6XQYLVPABNINDMF3VF66AYLW4, 24 October 2026 (cited by CERT-FR; not reviewed for this note). https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/ - CVE-2026-114583 record. https://www.cve.org/CVERecord?id=CVE-2026-114583 - CVE-2026-115557 record. https://www.cve.org/CVERecord?id=CVE-2026-115557 ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-115557 at CVSS 9.4 CRITICAL (CWE-299) and CVE-2026-114583 at CVSS 6.9 MEDIUM, neither in CISA KEV, with EPSS of 1% and 0% respectively; the severity is high but there is no exploitation signal, so this is a patch-and-scope task, not an incident. The client impact is concentrated in embedded CPython: services that rely on the interpreter's TLS revocation checking, and any third-party product shipping an unpatched build, carry the exposure. The technical mechanism is unconfirmed because the only source is a single CERT-FR bulletin that defers to two upstream Python threads we have not yet read. We will obtain those threads, extract the affected and fixed version ranges, and reissue this advisory with the version matrix and any detection content the upstream detail supports; clients running CPython in internet-facing or certificate-trust paths should complete the P1 inventory now rather than wait for that revision. --- [Read the original source →](https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1379/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*