The defect is that ssl.SSLContext.wrap_bio() does not require the server_hostname argument when ssl.SSLContext.check_hostname is set. As a result, if an application omits the hostname, the SSLObject skips hostname verification and the handshake completes without raising an exception. This can give developers a false sense that certificate validation succeeded while an attacker could substitute a rogue certificate. The vulnerability is a classic example of missing validation (CWE‑295) and implicit trust (CWE‑297).

The flaw targets the Python Software Foundation’s CPython interpreter. It impacts any CPython installation that calls SSLContext.wrap_bio, asyncio.create_connection, or asyncio.loop.start_tls without supplying a non‑empty server_hostname. The CNA list does not specify an affected version range, so any CPython release before the patch is potentially vulnerable.

With a CVSS score of 7.6 the severity is high, but the exploit probability is unknown because no EPSS score is provided, and the vulnerability is not in the CISA KEV catalog. The likely attack vector is an application that calls the affected APIs without supplying a server_hostname; an attacker could present a forged certificate to the client, causing it to accept the connection. This scenario is inferred from the description, as the vulnerability reveals a missing runtime check rather than an externally exploitable network flaw, so the feasibility depends on how often code neglects to provide a hostname. Nonetheless, the potential for a man‑in‑the‑middle attack justifies a high priority value.