CPython SSL SNI Callback Crash via Freed SSLContext fixed 3.12.15/3.13.16/3.14.8
CVE-2026-19445 Published on September 30, 2026
Use-after-free of a server-side SSLContext when sni_callback switches contexts
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.
Mitigation: keep a reference to every SSLContext that sets sni_callback for
the lifetime of the server. TLS clients are not affected.
Vulnerability Analysis
CVE-2026-19445 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-19445 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-19445
Want to know whenever a new CVE is published for Python? stack.watch will email you.
Affected Versions
Python Software Foundation CPython:- Before 3.12.15 is affected.
- Version 3.13.0 and below 3.13.16 is affected.
- Version 3.14.0 and below 3.14.8 is affected.
- Version 3.15.0a1 and below 3.15.0 is affected.