CPython EUVD-2026-118275

Three concrete, simultaneous prerequisites are required: (1) OpenSSL must be configured in FIPS mode - the description states 'Only users that are using OpenSSL in FIPS mode are affected'; (2) the interpreter must be exactly Python 3.14.10, as 'all other Python versions are unaffected'; and (3) code must invoke the hashlib module requesting security use (usedforsecurity=True), the exact path fixed in the patch (fetching the '-fips' property). These conditions sharply limit real-world exposure: FIPS mode is a non-default, regulated-environment configuration, and only a single point release is affected, so the vast majority of Python deployments are not at risk. The CVSS AT:P flag reflects this FIPS-mode dependency as a condition outside the attacker's control.

The vendor CVSS 4.0 base score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N) is driven almost entirely by a single High integrity impact (VI:H) with no confidentiality or availability impact (VC:N/VA:N) and no subsequent-system impact (SC/SI/SA:N). The AT:P flag signals that exploitation requires a condition outside the attacker's control, which the description makes explicit: OpenSSL must be running in FIPS mode and the interpreter must be exactly Python 3.14.10 - every other Python version is unaffected. No EPSS score is provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit or PoC reference (the only linked code is the vendor's fix PR), so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week,' consistent with a patch-available, moderate-urgency integrity regression rather than an emergency. Net assessment: this is a genuine but tightly scoped integrity/compliance defect, not a broad high-risk remote vulnerability - real priority is limited to organizations running the single affected release in OpenSSL FIPS mode (typically regulated/government environments). Note a data conflict: the 'Information Disclosure' tag contradicts the CVSS vector, which shows VC:N (no confidentiality impact) and VI:H, i.e. this is an integrity/FIPS-enforcement issue, not information disclosure.

In an environment running Python 3.14.10 against OpenSSL in FIPS mode, an application calls hashlib with usedforsecurity=True expecting FIPS-approved-algorithm enforcement; due to the inverted FIPS-property logic the enforcement does not behave as intended, undermining the cryptographic/compliance integrity guarantee. Because the vector is AV:N/AC:L but gated by AT:P, the flaw manifests under the specific FIPS deployment condition rather than through a crafted remote attack. No public exploit or PoC code exists at time of analysis.