Vulnerability Spotlight: Python.org certificate parsing denial-of-service

Summary: Cisco Talos discovered a denial-of-service vulnerability in Python.org's X509 certificate parser, where a specially crafted certificate with a blank distributionPoint and cRLIssuer in its DistributionPoint extension causes a NULL pointer dereference and crashes Python when getpeercert() is called on a TLS connection. Talos confirmed versions 2.7.11, 3.6.6, 3.5.2 and 3 master at commit 480833808e918a1dcebbbcfd07d5a8de3c5c2a66 are affected, tracked as TALOS-2018-0758/CVE-2018-5010, and worked with Python on an update.
What's compelling: Any service that parses peer certificates in TLS - and calls getpeercert() - can be crashed by a single malformed certificate, so the exposure is a remote attacker versus your availability, not a local bug.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2018-5010
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026