Skip to content
OpenAdvisories
Critical RHSA-2026:74867 1 CVE

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Oct 6, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 14

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 python3.15 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-debug 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-devel 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-freethreading 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-freethreading-debug 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-freethreading-devel 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-freethreading-idle 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-freethreading-libs 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-freethreading-test 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-freethreading-tkinter 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-idle 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-libs 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-test 0:3.15.0~rc2-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.15-tkinter 0:3.15.0~rc2-1.1.hum1

Vulnerabilities 1

  • Critical 9.2
    CVE-2026-19445 Public exploit

    Use-after-free of a server-side SSLContext when sni_callback switches contexts

    A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-19445
  • article
    https://access.redhat.com/security/updates/classification/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74867.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2544138
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19445
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19445
  • article
    https://github.com/python/cpython/issues/156293
  • article
    https://github.com/python/cpython/pull/158504
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/