CPython 3.14.10: hashlib stops enforcing FIPS algorithm restrictions under OpenSSL FIPS mode

CVSS 8.2CVE-2026-119170Kernel, userspace & hypervisorcurated

Impact

A regression in Python 3.14.10 means hashlib no longer enforces the FIPS algorithm restrictions it should when OpenSSL is running in FIPS mode, so code that expects a non-approved digest to be refused gets it computed instead. This is a compliance and integrity problem rather than a remote attack path: a fleet operating under a FIPS obligation (government HPC, regulated enterprise tenants) can silently fall out of the validated configuration anywhere Python touches hashing - cluster tooling, schedulers, data pipelines, training code. Only OpenSSL FIPS mode users are affected, and only this one Python point release; every other version is unaffected. The record does not describe any exploit beyond the loss of enforcement.

Who can reach it

Not an access-gated flaw - it is a behaviour regression that applies to any process running Python 3.14.10 against OpenSSL in FIPS mode. Nothing needs to be reachable by an attacker for the enforcement gap to exist.

What to do

Move off Python 3.14.10 to another 3.14 release, then restart the Python services and re-run any job that relied on FIPS enforcement; nodes do not need to be drained or rebooted. Fleets that do not run OpenSSL in FIPS mode need do nothing. The record does not name the specific release carrying the fix, only the upstream issue and pull request.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-119170 https://github.com/python/cpython/issues/160923 https://github.com/python/cpython/pull/160984 https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.