--- id: CVE-2026-19445 title: |- A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing el… summary: |- A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing el… severity: critical cvss: 9.2 cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N' cwe: - CWE-416 vendor: Python Software Foundation product: CPython affected: - CPython < 3.10.22 - CPython >= 3.11.0 < 3.11.17 - CPython >= 3.12.0 < 3.12.15 - CPython >= 3.13.0 < 3.13.16 - CPython >= 3.14.0 < 3.14.8 - CPython >= 3.15.0a1 < 3.15.0rc3 published: '2026-09-30' updated: '2026-10-03' sourceUpdated: '2026-10-03T01:17:24.930' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19445' references: - url: >- https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d label: cna@python.org - url: >- https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b label: cna@python.org - url: >- https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7 label: cna@python.org - url: >- https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8 label: cna@python.org - url: >- https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698 label: cna@python.org - url: >- https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c label: cna@python.org - url: >- https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b label: cna@python.org - url: 'https://github.com/python/cpython/issues/156293' label: cna@python.org - url: 'https://github.com/python/cpython/pull/158504' label: cna@python.org - url: >- https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/ label: cna@python.org - url: 'http://www.openwall.com/lists/oss-security/2026/09/30/17' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19445.json - url: 'https://access.redhat.com/security/cve/CVE-2026-19445' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2544138' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-19445' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19445' - url: 'https://access.redhat.com/errata/RHSA-2026:74867' - url: 'https://access.redhat.com/errata/RHSA-2026:77028' - url: 'https://access.redhat.com/errata/RHSA-2026:77020' - url: 'https://access.redhat.com/errata/RHSA-2026:77018' - url: 'https://access.redhat.com/errata/RHSA-2026:85239' - url: 'https://access.redhat.com/errata/RHSA-2026:89742' - url: 'https://access.redhat.com/errata/RHSA-2026:77017' - url: 'https://access.redhat.com/errata/RHSA-2026:77021' - url: 'https://access.redhat.com/errata/RHSA-2026:87400' - url: 'https://access.redhat.com/errata/RHSA-2026:82939' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat cvssSource: cna epss: 0.00524 epssPercentile: 0.44292 exploits: github: 1 githubRepos: - 'https://github.com/abraxas/cve-2026-19445-sni-uaf' checkedAt: '2026-10-27T17:01:20.502Z' exploitAvailable: true ingestedAt: '2026-09-30T17:13:20.841Z' patched: - hardened_images scores: cna: 9.2 vendor: 8.1 --- ## Overview A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:74867** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:74867) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19445.json) - **RHSA-2026:77028** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-10-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:77028) - **RHSA-2026:77020** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77020) - **RHSA-2026:77018** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77018) - **RHSA-2026:85239** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85239) - **RHSA-2026:89742** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-10-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:89742) - **RHSA-2026:77017** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77017) - **RHSA-2026:77021** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77021) - **RHSA-2026:87400** · Red Hat · fixed in: Red Hat Cost Management On-Premise 1 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87400) - **RHSA-2026:82939** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:82939)