Summary
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)
* python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | python-unversioned-command | 3.12.15-1.el10_2 |
| AlmaLinux · 10 | python3 | 3.12.15-1.el10_2 |
| AlmaLinux · 10 | python3-debug | 3.12.15-1.el10_2 |
| AlmaLinux · 10 | python3-devel | 3.12.15-1.el10_2 |
| AlmaLinux · 10 | python3-idle | 3.12.15-1.el10_2 |
| AlmaLinux · 10 | python3-libs | 3.12.15-1.el10_2 |
| AlmaLinux · 10 | python3-test | 3.12.15-1.el10_2 |
| AlmaLinux · 10 | python3-tkinter | 3.12.15-1.el10_2 |
Vulnerabilities 2
-
Critical 9.2CVE-2026-19445 Public exploit
Use-after-free of a server-side SSLContext when sni_callback switches contexts
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …
-
High 7.6CVE-2026-19553 Public exploit
SSLContext.wrap_bio() missing validation of server_hostname parameter
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be si…