CVE-2026-19445

A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.sni_callback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the server process or result in a call through a freed pointer. Servers that wrap their listening socket with a long-lived SSLContext are not affected. TLS clients are not affected.

This issue is rated Important. A remote unauthenticated client can trigger a server-side use-after-free when SNI callback code switches SSLSocket.context and drops the last reference to the original SSLContext, which can crash the process or call through a freed pointer (C:H/I:H/A:H). It is not Critical: exploitation requires a specific, non-default server pattern (per-connection or replaced SSLContext with sni_callback); the common pattern of wrapping the listening socket is explicitly not affected, so Attack Complexity is High. Red Hat ASLR, NX, and glibc heap hardening raise the bar for reliable code execution from the UAF but do not remove the crash/DoS impact, so Availability remains High.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict Python TLS servers that use SSLContext.sni_callback to trusted clients. Keep a strong reference to every SSLContext that registers an SNI callback for the lifetime of the server so the original context cannot be garbage-collected while connections remain open. Prefer wrapping the listening socket with a long-lived SSLContext; that common pattern is not affected. Host heap allocator hardening increases the difficulty of turning the use-after-free into reliable code execution but does not prevent process crashes.