CVE-2026-19445
published 2026-09-30CVE-2026-19445: A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to…
PriorityP351critical9.2CVSS 4.0
AVNACHATPPRNUINVCHVIHVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.43%
36.1th percentile
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.
Mitigation: keep a reference to every SSLContext that sets sni_callback for
the lifetime of the server. TLS clients are not affected.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python3.11 | — | — |
| debian | python3.14 | — | — |
| debian | python3.9 | — | — |
| python36_3.6 | python36 | — | — |
| python_software_foundation | cpython | < 3.10.22 | 3.10.22 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.17 | 3.11.17 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.15 | 3.12.15 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.16 | 3.13.16 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.8 | 3.14.8 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0rc3 | 3.15.0rc3 |
| ubuntu | python3.12 | — | — |
CVSS provenance
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.2CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Python up to 3.15.x SSL Context Management Modules/_ssl.c sni_callback context use after free (EUVD-2026-90077)
vuldb·2026-10-01·CVSS 9.2
CVE-2026-19445 [CRITICAL] Python up to 3.15.x SSL Context Management Modules/_ssl.c sni_callback context use after free (EUVD-2026-90077)
A vulnerability classified as problematic was found in Python up to 3.15.x. This affects the function sni_callback of the file Modules/_ssl.c of the component SSL Context Management. Such manipulation of the argument context leads to use after free.
This vulnerability is traded as CVE-2026-19445. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is advised.
GHSA
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certif
ghsa_unreviewed·2026-09-30
CVE-2026-19445 [CRITICAL] CWE-416 A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certif
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.
Mitigation: keep a reference to every SSLContext that sets sni_callback for
the lifetime of the server. TLS clients are not affected.
Red Hat
python: Use-after-free of a server-side SSLContext when sni_callback switches contexts
vendor_redhat·2026-09-30·CVSS 9.2
CVE-2026-19445 [CRITICAL] CWE-416 python: Use-after-free of a server-side SSLContext when sni_callback switches contexts
python: Use-after-free of a server-side SSLContext when sni_callback switches contexts
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.
Mitigation: keep a reference to every SSLContext that sets sni_callback for
the lifetime of the server. TLS clients are not affected.
A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLCon
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-19445 python3.13: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
bugzilla·2026-10-05·CVSS 9.2
CVE-2026-19445 [CRITICAL] CVE-2026-19445 python3.13: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
CVE-2026-19445 python3.13: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected
Bugzilla
CVE-2026-19445 python3.6: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
bugzilla·2026-10-05·CVSS 9.2
CVE-2026-19445 [CRITICAL] CVE-2026-19445 python3.6: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
CVE-2026-19445 python3.6: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.
Bugzilla
CVE-2026-19445 python3.11: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
bugzilla·2026-10-05·CVSS 9.2
CVE-2026-19445 [CRITICAL] CVE-2026-19445 python3.11: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
CVE-2026-19445 python3.11: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected
Bugzilla
CVE-2026-19445 python3.12: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
bugzilla·2026-10-05·CVSS 9.2
CVE-2026-19445 [CRITICAL] CVE-2026-19445 python3.12: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
CVE-2026-19445 python3.12: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected
Bugzilla
CVE-2026-19445 python3.14: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
bugzilla·2026-10-05·CVSS 9.2
CVE-2026-19445 [CRITICAL] CVE-2026-19445 python3.14: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
CVE-2026-19445 python3.14: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected
Bugzilla
CVE-2026-19445 python3.9: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
bugzilla·2026-10-05·CVSS 9.2
CVE-2026-19445 [CRITICAL] CVE-2026-19445 python3.9: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
CVE-2026-19445 python3.9: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.
Bugzilla
CVE-2026-19445 mingw-python3: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
bugzilla·2026-10-05·CVSS 9.2
CVE-2026-19445 [CRITICAL] CVE-2026-19445 mingw-python3: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
CVE-2026-19445 mingw-python3: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affec
Bugzilla
CVE-2026-19445 python3.13: Use-after-free of a server-side SSLContext when sni_callback switches contexts [epel-all]
bugzilla·2026-10-05·CVSS 9.2
CVE-2026-19445 [CRITICAL] CVE-2026-19445 python3.13: Use-after-free of a server-side SSLContext when sni_callback switches contexts [epel-all]
CVE-2026-19445 python3.13: Use-after-free of a server-side SSLContext when sni_callback switches contexts [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.
Bugzilla
CVE-2026-19445 python3.10: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
bugzilla·2026-10-05·CVSS 9.2
CVE-2026-19445 [CRITICAL] CVE-2026-19445 python3.10: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
CVE-2026-19445 python3.10: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected
Bugzilla
CVE-2026-19445 python3.15: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
bugzilla·2026-10-05·CVSS 9.2
CVE-2026-19445 [CRITICAL] CVE-2026-19445 python3.15: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
CVE-2026-19445 python3.15: Use-after-free of a server-side SSLContext when sni_callback switches contexts [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected
Bugzilla
CVE-2026-19445 python: Use-after-free of a server-side SSLContext when sni_callback switches contexts
bugzilla·2026-09-30·CVSS 9.2
CVE-2026-19445 [CRITICAL] CVE-2026-19445 python: Use-after-free of a server-side SSLContext when sni_callback switches contexts
CVE-2026-19445 python: Use-after-free of a server-side SSLContext when sni_callback switches contexts
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.
Mitigation: keep a reference to every SSLContext that sets sni_callback for
the lifetime of the server. TLS clients are not affected.
https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053dhttps://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552bhttps://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2chttps://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24bhttps://github.com/python/cpython/issues/156293https://github.com/python/cpython/pull/158504https://mail.python.org/archives/list/[email protected]/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/http://www.openwall.com/lists/oss-security/2026/09/30/17
2026-09-30
Published