CVE-2026-19553

A flaw was found in Python. When establishing secure connections using the SSLContext.wrap_bio() function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rather than triggering an error. A remote man-in-the-middle attacker could exploit this defect to spoof trusted endpoints and intercept or tamper with sensitive encrypted traffic.

This issue is rated Important because a man-in-the-middle attacker can cause Python clients using SSLContext.wrap_bio() (or asyncio TLS helpers that call it) to skip certificate hostname verification when check_hostname is enabled but server_hostname is omitted or empty, compromising confidentiality and integrity of the TLS session (C:H/I:H). It is not Critical: exploitation requires an on-path attacker and that specific API misuse (AC:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped.