CPython [CVE-2026-19445] Use-after-free of a server-side SSLContext when sni_callback switches contexts

CVE-2026-19445 is a use-after-free (CWE-416) in CPython’s server-side TLS handling. A remote, unauthenticated TLS client can crash the process or cause a call through a freed pointer when an sni_callback—the documented way to pick a certificate per server name—assigns a different SSLContext to SSLSocket.context and nothing else keeps the original context alive. Typical risky cases are servers that create an SSLContext per connection or replace one while connections are still open; servers that only wrap the listening socket, and all TLS clients, are not affected. Impact is primarily availability, with the CVSS 4.0 score of 9.2 also reflecting possible high confidentiality and integrity effects from the freed-pointer use. It is not on the CISA KEV list and no public proof-of-concept is known.

Do: Keep a live reference to every ssl.SSLContext that sets sni_callback for the entire lifetime of the server, including when the callback assigns a different context to SSLSocket.context. Do not create or replace an SSLContext per connection unless the original context stays referenced. TLS clients and servers that only wrap the listening socket are not affected by this bug; no fixed release is named in the advisory data, so track the CPython update for CVE-2026-19445 and upgrade when it is published.