Python 3.14.10: FIPS enforcement regression

Python Software Foundation CPython

A high severity vulnerability affecting CPython 3.14.10 due to a regression in FIPS enforcement of hash algorithms.

Do this now

Check the Python Software Foundation advisory for a fix to the CPython 3.14.10 FIPS hash regression and restrict access to affected systems meanwhile.

Who should check: teams running Python

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 22:17 UTC
Versions per the CVE record from PSF, not the vendor: 3.14.11
Identifiers: CVE-2026-119170
CVSS: 8.2
Source: news
On the menu as: Python

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Python 3.14.10: FIPS enforcement regression
Severity: high. Patch status: fix status unknown.
Affected: Python Software Foundation CPython
Versions per the CVE record from PSF, not the vendor: 3.14.11
Ids: CVE-2026-119170

A high severity vulnerability affecting CPython 3.14.10 due to a regression in FIPS enforcement of hash algorithms.

## Steps
1. Search the repo, its CI and infra config for Python Software Foundation CPython. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from PSF, not the vendor: CPython: 3.14.x → 3.14.11. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| CPython 3.14.x | per the CVE record from PSF, not the vendor | 3.14.11 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-119170") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/564
https://pwned.coffee/i/python-3-14-10-fips-enforcement-regression-cve-2026-119170

Timeline

6 Nov 2026, 22:17 UTC
Fix status: no fix yet → unknown.
6 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from PSF, not the vendor: Product Affected Version named Source
CPython 3.14.10 to before 3.14.11 3.14.11 CVE record (CNA) per the CVE record from PSF, not the vendor checked 6 Nov
Score: CVSS 8.2 (high). CVSS 4.0 8.2 (CNA PSF) for CVE-2026-119170
Last checked: 7 Nov 2026, 18:18 UTC

Product	Affected	Version named	Source
CPython	3.14.10 to before 3.14.11	3.14.11	CVE record (CNA) per the CVE record from PSF, not the vendor checked 6 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

seclists.org: [oss-security][CVE-2026-119170] Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

Follow on X

Totalone hot coffee