Bénédikt Tran

When ca certs parameter was supplied to ssl.get server certificate() function, the identity of the certificate is not checked.

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.

The `ssl.SSLContext.wrap bio()` function fails to require the `server hostname` argument to be non-null when `ssl.SSLContext.check hostname` is enabled. Due to a missing parameter check in `SSLObject`, if the `server hostname` argument is not provided, hostname verification is silently skipped. This can lead to scenarios where certificate hostname verification appears to succeed despite misconfiguration, as no `ValueError` is raised. This issue also affects `asyncio.create connection()` and `asyncio.loop.start tls()`. If a `server hostname` value that is neither an empty string nor None is passed to these APIs, verification proceeds normally.

A remote, unauthenticated TLS client can cause a server to crash or trigger a use-after-free condition (where the system attempts to use a memory pointer after it has been freed) if the `sni callback` assigns a different context to `SSLSocket.context` and the original `ssl.SSLContext` is not kept alive. This typically occurs in servers that replace the context while connections are open or create an `SSLContext` per connection. Servers that wrap their listening socket are not affected.

The `unicodedata.normalize()` function can consume excessive CPU time when processing specially crafted Unicode input. This occurs when the input contains long sequences of combining characters with alternating Canonical Combining Class values, affecting all normalization forms.

The `ftpcp()` function in Lib/ftplib.py fails to use the actual peer address, instead trusting the host address supplied by the server during a PASV command. This occurs because `ftpcp()` calls `parse227()` directly and passes the raw, attacker-controllable IP address and port to `target.sendport()`, leading to a Server-Side Request Forgery (SSRF), where a server is tricked into making unintended requests to internal or external resources.

The Expat parser, when used with a registered ElementDeclHandler, is susceptible to a C stack overflow when processing an inline document type definition with a deeply nested content model. This occurs during the parsing of XML documents containing complex and deeply nested DTD content models.