CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
CVSS Score
0.0
EPSS Score
0.4%
EPSS Percentile
35th
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
| CWE | CWE-416 |
| Vendor | python software foundation |
| Product | cpython |
| Published | Sep 30, 2026 |
| Last Updated | Oct 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.10.22 3.11.0 < 3.11.17 3.12.0 < 3.12.15 3.13.0 < 3.13.16 3.14.0 < 3.14.8 3.15.0a1 < 3.15.0rc3
References
github.com: https://github.com/python/cpython/pull/158504 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/ github.com: https://github.com/python/cpython/issues/156293 github.com: https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d github.com: https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b github.com: https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7 github.com: https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698 github.com: https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c github.com: https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8 github.com: https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b openwall.com: http://www.openwall.com/lists/oss-security/2026/09/30/17
Credits
🔍 Gregory P. Smith (https://github.com/gpshead) Seth Larson (https://github.com/sethmlarson) Bénédikt Tran (https://github.com/picnixz)