CVE-2026-19445

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)

• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)

• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)

• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)

• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)

• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345)

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)

• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345)

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)

• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)
• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)
• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)
• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)
• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)
• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345)
• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)
• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345)
• python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)
• python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected.

Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected.

Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected.

Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected.

Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.

• SECURITY UPDATE: use-after-free in the ssl servername (SNI) callback (CVE-2026-19445)
  • debian/patches/CVE-2026-19445.patch: look the SSLContext up from the SSL object instead of the borrowed pointer registered with OpenSSL, hold references to it and to the callback while it runs, and unregister the callback when the SSLContext is deallocated in Modules/_ssl.c, so that a later ClientHello can no longer reach a released SSLContext; add a regression test to Lib/test/test_ssl.py and a note to Doc/library/ssl.rst
  • CVE-2026-19445

• CVE-2026-19445: ssl: look up the servername callback context from the connection and unregister the callback on context deallocation, preventing a use-after-free of a released SSLContext

• CVE-2026-19445: fix use-after-free in the ssl servername (SNI) callback - the callback reached its SSLContext through a borrowed pointer registered with OpenSSL, so once the callback switched SSLSocket.context to another context and nothing else referenced the original one, the freed object was used after the callback returned or on a later ClientHello. Look the context up from the connection instead and unregister the callback when the context is deallocated. Backported from upstream CPython (gh-156293, GH-158504).

• CVE-2026-19445: fix use-after-free in the ssl servername (SNI) callback - the callback reached its SSLContext through a borrowed pointer registered with OpenSSL, so once the callback switched SSLSocket.context to another context and nothing else referenced the original one, the freed object was used after the callback returned or on a later ClientHello. Look the context up from the connection instead and unregister the callback when the context is deallocated. Backported from upstream CPython (gh-156293, GH-158504).

• CVE-2026-19445: fix use-after-free in the ssl servername (SNI) callback - the callback reached its SSLContext through a borrowed pointer registered with OpenSSL, so once the callback switched SSLSocket.context to another context and nothing else referenced the original one, the freed object was used after the callback returned or on a later ClientHello. Look the context up from the connection instead and unregister the callback when the context is deallocated. Backported from upstream CPython (gh-156293, GH-158504).

• CVE-2026-19445: ssl: do not call the servername callback through a released SSLContext (use-after-free when the callback switches SSLSocket.context)

• CVE-2026-19445: ssl: do not call the servername callback through a released SSLContext (use-after-free when the callback switches SSLSocket.context)

• CVE-2026-19445: ssl: do not call the servername callback through a released SSLContext (use-after-free when the callback switches SSLSocket.context)

• CVE-2026-19445: ssl: look up the servername callback's context from the live socket instead of a borrowed pointer, and clear the callback when a context is deallocated, so switching contexts from the callback can no longer leave a freed SSLContext reachable

• SECURITY UPDATE: use-after-free in the ssl servername (SNI) callback (CVE-2026-19445)
  • debian/patches/CVE-2026-19445.patch: look the SSLContext up from the SSL object instead of the borrowed pointer registered with OpenSSL, hold references to it and to the callback while it runs, and unregister the callback when the SSLContext is deallocated in Modules/_ssl.c, so that a later ClientHello can no longer reach a released SSLContext; add a regression test to Lib/test/test_ssl.py and a note to Doc/library/ssl.rst
  • CVE-2026-19445

• CVE-2026-19445: fix a use-after-free in the SNI servername callback (_servername_callback in Modules/_ssl.c)

• CVE-2026-19445: ssl: resolve the SSLContext for the SNI servername callback from the connection instead of the borrowed SSL_CTX argument, and unregister the callback in context_dealloc, so a context dropped after sni_callback switched the connection is no longer used after it is freed
• CVE-2026-19553: ssl: validate SSLContext.wrap_bio() arguments in SSLObject._create the way wrap_socket() does - reject server_hostname and session in server mode, and emit a DeprecationWarning when check_hostname is enabled but no server_hostname is given, surfacing the misconfiguration that made certificate hostname verification be skipped silently

• CVE-2026-19445: ssl: take a strong reference to the live SSLContext of the connection inside the SNI servername callback and clear the servername callback when a context is freed, so a server callback that switches contexts and drops the original no longer reads freed memory

• SECURITY UPDATE: hostname verification silently skipped by SSLContext.wrap_bio() when no server_hostname is given
  • debian/patches/CVE-2026-19553.patch: in Lib/ssl.py, validate the wrap_bio() arguments like wrap_socket() does: reject server_hostname and session in server mode, and emit a DeprecationWarning when check_hostname is enabled but server_hostname is None, so a client that verified the certificate chain but never the peer's identity is no longer silent about it (asyncio's create_connection()/start_tls() reach this path too). Backport of upstream commit 5867d4e4ae6d (gh-156793 / GH-158503, 3.10 branch, which warns instead of raising ValueError for backward compatibility). Bundles the upstream regression tests (test_ssl.py, test_sslproto.py), adapted to the 3.7 test.support API.
  • CVE-2026-19553
• SECURITY UPDATE: use-after-free in the SSL servername (SNI) callback
  • debian/patches/CVE-2026-19445.patch: in Modules/_ssl.c, look the SSLContext up from the connection instead of the borrowed pointer registered with OpenSSL, hold strong references to it and to the callback while they are used, and unregister the callback when the context is deallocated, so a TLS client can no longer make a server call through a freed SSLContext after sni_callback switched the connection to another context. Backport of upstream commit ec44b5a3258c (gh-156293 / GH-158504, 3.10 branch); Py_NewRef() is replaced by Py_INCREF() for 3.7. Bundles the upstream regression tests (test_ssl.py), adapted to the 3.7 test.support API.
  • CVE-2026-19445

• CVE-2026-19445: ssl: look up the SSLContext for the servername (SNI) callback from the SSL connection instead of a borrowed pointer, and unregister the callback when the context is deallocated

• SECURITY UPDATE: use-after-free in server-side SSL SNI callbacks
  • debian/patches/CVE-2026-19445.patch: stop using a borrowed SSLContext callback argument, retain the current context and callback during SNI dispatch, and unregister the callback before context teardown; add regression tests for callback exceptions and TLS 1.3 HelloRetryRequest redispatch
  • CVE-2026-19445

• CVE-2026-19445: prevent a use-after-free in server-side SSLContext SNI callbacks
• CVE-2026-19553: validate SSLContext.wrap_bio() hostname and server-side parameters

• SECURITY UPDATE: use-after-free in the ssl servername (SNI) callback
  • debian/patches/CVE-2026-19445.patch: take the SSLContext from the connection and hold references to it and to the callback while the callback runs, instead of using the borrowed pointer registered with OpenSSL, and unregister the callback when the context is deallocated, in Modules/_ssl.c, so a servername callback that switches the connection to another context can no longer make the server call through a freed SSLContext.
  • CVE-2026-19445

• CVE-2026-19445: prevent use-after-free in the TLS server name callback when switching SSL contexts
• CVE-2026-19553: validate SSLObject server hostname and session parameters before wrapping memory BIOs

• SECURITY UPDATE: use-after-free in the ssl module when a servername callback switches the connection to another SSLContext
  • debian/patches/CVE-2026-19445.patch: look the SSLContext up from the SSL object instead of the borrowed servername-callback argument and hold references to it and to the callback while they are used, and unregister the callback when the context is deallocated, in Modules/_ssl.c, so a TLS client can no longer make the server call through a freed SSLContext; adds the upstream regression tests to Lib/test/test_ssl.py.
  • CVE-2026-19445