-------- Forwarded Message --------
Subject: [Security-announce][CVE-2026-19445] Use-after-free of a server-side
SSLContext when sni_callback switches contexts
Date: Wed, 30 Sep 2026 16:10:08 +0000
From: Seth Larson <[email protected]>
Reply-To: [email protected]
To: [email protected]
There is a CRITICAL severity vulnerability affecting CPython.
A remote, unauthenticated TLS client can make a server crash or call through a
freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server name)
and nothing else keeps the original ssl.SSLContext alive. Typical cases are
servers that create an SSLContext per connection or replace it while connections
are open; servers that wrap their listening socket with it are not affected.
Mitigation: keep a reference to every SSLContext that sets sni_callback for the
lifetime of the server. TLS clients are not affected.
Please see the linked CVE ID for the latest information on affected versions:
* https://www.cve.org/CVERecord?id=CVE-2026-19445
* https://github.com/python/cpython/pull/158504
_______________________________________________
Security-announce mailing list -- [email protected]
https://mail.python.org/mailman3//lists/security-announce.python.org
