{"affected":[{"defaultStatus":"unaffected","product":"CPython","source":"CNA: PSF","vendor":"Python Software Foundation","versions":[{"lessThan":"3.14.11","status":"affected","version":"3.14.10","versionType":"python"}]}],"cveId":"CVE-2026-119170","cwes":["CWE-693"],"description":"There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: PSF","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.2,"severity":"high","source":"NVD: cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794010199293,"publishedAt":1793976611952,"references":[{"source":"CNA: PSF","tags":["issue-tracking"],"url":"https://github.com/python/cpython/issues/160923"},{"source":"CNA: PSF","tags":["vendor-advisory"],"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/"},{"source":"CNA: PSF","tags":["patch"],"url":"https://github.com/python/cpython/pull/160984"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/11/06/30"},{"source":"cna@python.org","tags":[],"url":"https://github.com/python/cpython/issues/160923"},{"source":"cna@python.org","tags":[],"url":"https://github.com/python/cpython/pull/160984"},{"source":"cna@python.org","tags":[],"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/"}],"remediation":[{"kind":"fix","source":"CNA: PSF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/python/cpython/pull/160984"}],"revision":"5096686d67b49bb172a10519f917332ba58af7a5f6d690d4da2ecd6673b3d1d5","sources":[{"modifiedAt":1794010199293,"name":"CNA: PSF","retrievedAt":1794013699803,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119170"},{"modifiedAt":1793989077750,"name":"NVD","retrievedAt":1794011169044,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119170"}],"ssvc":{"assessedAt":1793985785321,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10","updatedAt":1794013699803}