一、漏洞信息
漏洞编号：CVE-2026-19553
漏洞归属组件：python3
漏洞归属的版本：3.10.2,3.10.9,3.11.11,3.11.13,3.11.4,3.11.6,3.7.9,3.8.5,3.9.9
CVSS评分：
BaseScore：7.6 High
Vector：CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
漏洞简述：
ssl.SSLContext.wrap_bio() didn t require the server_hostname argumentto not be None if ssl.SSLContext.check_hostname was set. Due to amissing parameter check in SSLObject, if the server_hostname argumentisn t supplied then hostname verification would be silently skipped.This defect could lead to programs where certificate hostname verificationappeared to be succeeding with SSLContext.check_hostname = True and noValueError being raised due to misconfiguration.If the program passes a server_hostname value that isn t an empty stringor None to any of these APIs then certificate hostname verificationproceeds as expected and the program is not affected by this vulnerability.Mitigating this vulnerability doesn t require updating Python or applyingthe patch. To mitigate, pass a valid non-None and non-emptyserver_hostname value to SSLContext.wrap_bio(),asyncio.create_connection(), or asyncio.loop.start_tls() andcertificate hostname verification will proceed as expected. Upgrading tothe latest version of Python or applying the patch only changes thebehavior from silently skipping hostname verification to raising aValueError, similar to SSLContext.wrap_socket(), when server_hostnameisn t supplied.
漏洞公开时间：2026-10-01 01:16:45
漏洞创建时间：2026-10-10 04:57:21
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-19553

漏洞分析指导链接：
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
七彩瞬析开源风险感知平台
漏洞补丁信息：

二、漏洞分析结构反馈
影响性分析说明：
ssl.SSLContext.wrap_bio() didn t require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn t supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification appeared to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn t an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn t require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn t supplied.
openEuler评分：
7.6
Vector：CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
受影响版本排查(受影响/不受影响)：
1.master(3.11.13):受影响
2.openEuler-20.03-LTS-SP4(3.7.9):受影响
3.openEuler-22.03-LTS-SP4(3.9.9):受影响
4.openEuler-24.03-LTS-Next(3.11.6):受影响
5.openEuler-24.03-LTS-SP1(3.11.6):受影响
6.openEuler-24.03-LTS-SP3(3.11.6):受影响
7.openEuler-24.03-LTS-SP4(3.11.6):受影响

修复是否涉及abi变化(是/否)：
1.master(3.11.13):否
2.openEuler-20.03-LTS-SP4(3.7.9):否
3.openEuler-22.03-LTS-SP4(3.9.9):否
4.openEuler-24.03-LTS-Next(3.11.6):否
5.openEuler-24.03-LTS-SP1(3.11.6):否
6.openEuler-24.03-LTS-SP3(3.11.6):否
7.openEuler-24.03-LTS-SP4(3.11.6):否

原因说明：
1.master(3.11.13):正常修复
2.openEuler-20.03-LTS-SP4(3.7.9):正常修复
3.openEuler-22.03-LTS-SP4(3.9.9):正常修复
4.openEuler-24.03-LTS-Next(3.11.6):正常修复
5.openEuler-24.03-LTS-SP1(3.11.6):正常修复
6.openEuler-24.03-LTS-SP3(3.11.6):正常修复
7.openEuler-24.03-LTS-SP4(3.11.6):正常修复