A regression in the CPython 3.14.10 hashlib module caused the FIPS enforcement of hash algorithms to fail. When OpenSSL is configured in FIPS mode, the module no longer rejects algorithms that are not FIPS‑compliant, allowing the use of weak or disallowed hash functions. This undermines the cryptographic guarantees required in FIPS environments and can expose data to integrity or authentication attacks. The regression does not directly provide code execution or denial of service but compromises the security of cryptographic operations.

The vulnerability is limited to the CPython interpreter produced by the Python Software Foundation, specifically version 3.14.10. Only deployments that link OpenSSL in FIPS mode are affected; other Python versions, including earlier and later CPython releases, are not impacted. Users running Python 3.14.10 with OpenSSL FIPS enabled should be aware that hash functions no longer enforce the expected FIPS restrictions.

The CVSS score of 8.2 indicates a high severity issue that could seriously weaken cryptographic security. The EPSS score is not available, which does not confirm current exploitation likelihood but suggests insufficient data, so the risk assessment must rely on the high CVSS score. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. Since the flaw only affects a narrow version range and requires OpenSSL FIPS mode, the likely attack vector is users or processes that can influence hash algorithm selection in that environment, based on the description. An attacker who can run Python 3.14.10 in a FIPS‑mode OpenSSL context might force the use of non‑FIPS hash functions, potentially allowing them to forge signatures, tamper with integrity checks, or weaken password hashing mechanisms.