CPython CVE-2026-19553

Exploitation requires BOTH an application-side misconfiguration and an attacker-side network position. Affected code must call ssl.SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() with SSLContext.check_hostname = True while passing server_hostname as None or an empty string - in that exact state SSLObject silently skips peer-identity verification (certificate chain is still validated, but the hostname is never matched). The attacker must additionally hold a man-in-the-middle position on the connection path and be able to present a certificate that chains to a CA the client trusts. LIMITING FACTORS: applications that pass any valid non-None, non-empty server_hostname are completely unaffected regardless of patch status; the flaw does not affect SSLContext.wrap_socket() (which already validated); and no remote exploitation is possible without an active network-intercept position. Mitigation does not require the patch - supplying a valid server_hostname fully resolves it; the patch merely converts the silent skip into a ValueError.

This is a genuine TLS security-control failure (CWE-297 improper certificate hostname validation), not a high-CVSS-but-low-impact issue, but its real-world risk is gated by two independent conditions that sharply narrow exposure. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, 7.6) encodes that exploitation is network-based and unauthenticated but carries an Attack Requirement (AT:P) - a man-in-the-middle position - and a passive user-interaction element. The high VC:H/VI:H reflect that a successful MITM fully compromises the confidentiality and integrity of the affected TLS channel; VA:N correctly shows no availability impact. Critically, the flaw only manifests in applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() with check_hostname=True AND pass server_hostname as None or an empty string - a developer misconfiguration that silently disables peer-identity checking while chain verification still succeeds. No EPSS score, CISA KEV listing, or public exploit is present in the provided data (no public exploit identified at time of analysis). The signals are internally consistent: network vector with a MITM attack requirement means targeted, not mass/automatable, exploitation. Treat as a defense-in-depth / correctness fix of moderate priority; urgency rises only for code that matches the specific affected pattern.

A CPython application establishes a TLS client connection via asyncio.create_connection() or SSLContext.wrap_bio() with check_hostname=True but without supplying server_hostname (leaving it None or ''); the developer believes hostname verification is active. An attacker positioned on the network path (e.g., rogue Wi-Fi, ARP/DNS spoofing, or a compromised upstream) presents a certificate that is validly chained to a trusted CA but issued for a different hostname; because hostname matching is silently skipped, the connection succeeds and the attacker intercepts and modifies the traffic. No public exploit code is identified at time of analysis.