CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
| CWE | CWE-416 |
| Vendor | python software foundation |
| Product | cpython |
| Published | Sep 30, 2026 |
| Last Updated | Sep 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.16.0
References
github.com: https://github.com/python/cpython/pull/158504 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/ github.com: https://github.com/python/cpython/issues/156293 openwall.com: http://www.openwall.com/lists/oss-security/2026/09/30/17
Credits
🔍 Gregory P. Smith (https://github.com/gpshead) Seth Larson (https://github.com/sethmlarson) Bénédikt Tran (https://github.com/picnixz)