Two CPython SSL flaws disclosed, one rated critical

Python disclosed critical CPython use-after-free CVE-2026-19445 and high-severity wrap_bio hostname flaw CVE-2026-19553; notices cite no observed exploitation or fixed version.

On September 30, 2026, Alan Coopersmith forwarded two Python security announcements from Seth Larson to the oss-security list. CVE-2026-19445 is rated critical: a use-after-free occurs in a server-side SSLContext when an sni_callback switches contexts, and a remote unauthenticated TLS client can trigger it. CVE-2026-19553 is rated high because ssl.SSLContext.wrap_bio() omitted validation of the server_hostname parameter. The CVE-2026-19553 post is truncated, and neither notice reports observed exploitation or names a fixed version. The two reports do not conflict; they describe separate flaws disclosed through the same channel.

• CVE-2026-19445 is rated critical by the Python security team: a use-after-free in a server-side SSLContext when an sni_callback switches contexts.
• A remote, unauthenticated TLS client can trigger CVE-2026-19445; the published notice does not report in-the-wild exploitation.
• CVE-2026-19553 is rated high: ssl.SSLContext.wrap_bio() did not require validation of the server_hostname parameter.
• The oss-security text for CVE-2026-19553 is truncated and cites neither exploitation nor a fixed version.
• Seth Larson announced both issues on python.org security-announce; Alan Coopersmith forwarded the notices to oss-security on September 30, 2026.
• Neither available notice names a patched CPython version.