AI analysis
CVE-2026-19445 is a use-after-free (CWE-416) in CPython’s server-side TLS handling. A remote, unauthenticated TLS client can crash the process or cause a call through a freed pointer when an sni_callback—the documented way to pick a certificate per server name—assigns a different SSLContext to SSLSocket.context and nothing else keeps the original context alive. Typical risky cases are servers that create an SSLContext per connection or replace one while connections are still open; servers that only wrap the listening socket, and all TLS clients, are not affected. Impact is primarily availability, with the CVSS 4.0 score of 9.2 also reflecting possible high confidentiality and integrity effects from the freed-pointer use. It is not on the CISA KEV list and no public proof-of-concept is known.
What to do: Keep a live reference to every ssl.SSLContext that sets sni_callback for the entire lifetime of the server, including when the callback assigns a different context to SSLSocket.context. Do not create or replace an SSLContext per connection unless the original context stays referenced. TLS clients and servers that only wrap the listening socket are not affected by this bug; no fixed release is named in the advisory data, so track the CPython update for CVE-2026-19445 and upgrade when it is published.
Affected
| Python Software Foundation CPython (ssl module, server-side SNI) | — |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.