CVE-2026-119170

Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

8.2 High

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.49%Scored on 2026-11-07. The trend appears after a second daily score.

What each source reports

CVE List Score used 8.2

Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

Record: CVE-2026-119170
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-693
Updated: 2026-11-06

EUVDEUVD-2026-118275 8.2

Record: EUVD-2026-118275
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-07

GitHub AdvisoriesGHSA-vq78-g94j-3ppp 8.2

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users...

Record: GHSA-vq78-g94j-3ppp
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-693
Updated: 2026-11-07

NVD 8.2

Record: CVE-2026-119170
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-693
Updated: 2026-11-07

OSVDEBIAN-CVE-2026-119170 8.2

Record: DEBIAN-CVE-2026-119170
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-07

Affected products

python software foundation cpython

Affected packages

Affected packages
Package	Affected	Fixed
`python3.14` Debian:14	All versions, plus listed versions 3.14.0-13.14.0-23.14.0-33.14.0-43.14.0-5 Show 27 moreShow less 3.14.0~a7-13.14.0~b1-13.14.0~b2-13.14.0~b3-13.14.0~b4-13.14.0~rc1-13.14.0~rc2-13.14.0~rc3-13.14.10-13.14.2-13.14.3-13.14.3-23.14.3-33.14.3-43.14.3-53.14.4-13.14.4-23.14.5-13.14.5~rc1-13.14.6-13.14.7-13.14.7-23.14.7-33.14.7-43.14.7-53.14.8-13.14.9-1	None known

History

History
Recorded	Changed	Sources
Nov 7, 2026	affected, aliases, references	NVD, OSV
Nov 7, 2026	references	EUVD, GitHub Advisories, NVD
Nov 6, 2026	cwes	CVE List
Nov 6, 2026	published	EUVD, NVD
Nov 6, 2026	published	EUVD
Nov 6, 2026	aliases, published	EUVD
Nov 6, 2026	aliases, references	GitHub Advisories
Nov 6, 2026	first indexed	CVE List

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-119170 is a high vulnerability (CVSS 8.2) in Python Software Foundation Cpython, published November 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. No source names a fixed version.