by Kastro CVE-2026-19445
Python Software Foundation CPython — Use-after-free of a server-side SSLContext when sni_callback switches contexts
Description · from the CVE record
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
Affected
ProductAffectedFixed inSource
CPython< 3.10.223.10.22CNA
CPython3.11.0 – < 3.11.173.11.17CNA
CPython3.12.0 – < 3.12.153.12.15CNA
CPython3.13.0 – < 3.13.163.13.16CNA
CPython3.14.0 – < 3.14.83.14.8CNA
CPython3.15.0a1 – < 3.15.0rc33.15.0rc3CNA
Scores by source
PSF (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N