# CERT-FR Advisory on CPython Flaws

Published: 2026-10-26 · Severity: routine
Canonical: https://vorant.io/reports/fd9c4a4c-3c81-54d5-8396-86a33aea4ba2/cert-fr-advisory-on-cpython-flaws

> CERT-FR warns of multiple CPython vulnerabilities allowing attackers to bypass security policy; patches available from Python.

CERT-FR has issued an advisory covering multiple vulnerabilities in CPython, the reference implementation of the Python programming language. The flaws, tracked as CVE-2026-114583 and CVE-2026-115557, allow an attacker to cause a security policy bypass on affected systems running CPython versions that lack the latest security patches. No details of active exploitation are provided in this advisory.

The advisory references two Python security bulletins published on 22 and 24 October 2026 via the official security-announce mailing list. Defenders should consult the vendor bulletins for the specific affected versions and apply the available patches to remediate the issue. As a general-purpose language runtime, CPython is widely deployed across numerous environments, so organizations should prioritize patching systems where Python is used, particularly those exposed to untrusted input or network-facing services.

## Mentioned in this report

- Vulnerabilities: CVE-2026-114583, CVE-2026-115557

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1379

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fd9c4a4c-3c81-54d5-8396-86a33aea4ba2/cert-fr-advisory-on-cpython-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup