CVE-2026-115557: Python Software Foundation CPython

Affected products, as the CNA wrote them
Vendor	Product	Versions
Python Software Foundation	CPython	affected before 3.11.18 python affected 3.12.0 to before 3.12.16 python affected 3.13.0 to before 3.13.18 python affected 3.14.0 to before 3.14.10 python affected 3.15.0 to before 3.15.2 python affected 3.16.0a1 to before 3.16.0 python Other versions: unaffected

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
9.4	Critical	4.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	CNA (PSF)

CISA KEV Not listed.
EPSS 0.0053, the 45th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

24 Oct 2026, 14:15 UTC Confirmed by the CVE List
24 Oct 2026, 15:17 UTC Confirmed by NVD

Sources

CVE List: CVE-2026-115557
NVD: CVE-2026-115557

References from the CNA

www.openwall.com/lists/oss-security/2026/10/20/29 related
github.com/python/cpython/pull/160042 patch
github.com/python/cpython/issues/160040 issue-tracking
emudhra.we-have-a-problem.com/ third-party-advisory
mail.python.org/archives/list/[email protected]/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/ vendor-advisory
github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d patch
github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd patch
github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93 patch
github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6 patch
github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5 patch
github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b patch
github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90 patch
github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8 patch
github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78 patch
github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370 patch
github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e patch
github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3 patch

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.