Python's ssl module previously accepted any certificate chain unless explicit revocation was configured. This oversight allowed attackers to use compromised intermediate certificates to create seemingly valid TLS connections, enabling eavesdropping or credential theft. The issue is classified as a Trust Management flaw (CWE‑299) and carries a high severity of CVSS 9.4, indicating a serious threat to confidentiality and integrity.

The flaw affects the Python Software Foundation's CPython implementation. All CPython releases prior to the fix that do not contain the denylist for known compromised certificates are vulnerable, regardless of operating system or platform.

The vulnerability can be exploited during the SSL/TLS handshake when a client accepts a server certificate chain that includes a compromised intermediate. Attackers who control the intermediate can impersonate legitimate servers. The EPSS score is not available, but the high CVSS score and absence from the KEV catalog mean the risk remains significant unless mitigated with the official patch.