# CVE-2026-119170

RCE in Python hashlib when OpenSSL is in FIPS mode on Python 3.14.10.

- Page: https://www.vulneraibility.com/cve/CVE-2026-119170
- CVSS: 8.2
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-11-06)
- Weakness: CWE-693
- Published: 2026-11-06

## Affected versions

- Python Software Foundation CPython: affected >= 3.14.10 and < 3.14.11

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote code execution on hosts running Python 3.14.10 with OpenSSL FIPS mode due to a hashlib FIPS-enforcement regression.

## Action

Patch when possible

## Recommendation

Upgrade Python 3.14.10 to the fixed release and apply the CPython security patch; avoid using OpenSSL FIPS mode until patched.

## References

- [other] https://github.com/python/cpython/issues/160923
- [advisory] https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/
- [patch] https://github.com/python/cpython/pull/160984
- [other] http://www.openwall.com/lists/oss-security/2026/11/06/30

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.