PyPI/mercurial CVE-2010-4237: medium 5.9, EPSS 0.82%

Mercurial Improper Certificate Validation vulnerability

Action: Upgrade mercurial to 1.6.4 or later.

pip install mercurial==1.6.4

Affected

Fixed versions

Sources

• osv: PYSEC-2026-665
• https://nvd.nist.gov/vuln/detail/CVE-2010-4237
• https://github.com/dscho/hg/commit/4ea63fb25ceeeaaa4cd1026f733b7ea7672c30b3
• https://github.com/dscho/hg/commit/89baabf4fb7abf30ef6fdcf3d455a7893e5cc145
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598841
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4237
• https://bz.mercurial-scm.org/show_bug.cgi?id=2407
• https://repo.mercurial-scm.org/hg/rev/6ab4a7d3c179
• https://repo.mercurial-scm.org/hg/rev/f2937d6492c5
• https://security-tracker.debian.org/tracker/CVE-2010-4237
• https://pypi.org/project/mercurial
• https://github.com/advisories/GHSA-7gf7-7wx4-mxmw

CVE-2010-4237 · published 2026-07-02T14:13:17.606556Z · modified 2026-07-06T08:00:38.849597485Z · JSON