Skip to content
OpenAdvisories
Critical · 9.2 Public exploit CVE-2026-19445 EUVD-2026-90077GHSA-7jvw-f348-84gq

Use-after-free of a server-side SSLContext when sni_callback switches contexts

Published Sep 30, 2026 · Updated Nov 10, 2026 · Assigned by PSF

Vendor: Python Software Foundation Product: CPython Package: pypy3 Package: python2.7 Package: python3 Package: python3 Package: python3.10 Package: python3.11 Package: python3.11 Package: python3.12 Package: python3.13 Package: python3.14 Package: python3.14 Package: python3.15 Package: python3.4 Package: python3.5 Package: python3.6 Package: python3.7 Package: python3.8 Package: python3.9 Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.

Mitigation: keep a reference to every SSLContext that sets sni_callback for
the lifetime of the server. TLS clients are not affected.

Affected products

VendorProductAffectedFixed
Python Software Foundation CPython < 3.10.22, 3.11.0 – < 3.11.17, 3.12.0 – < 3.12.15, 3.13.0 – < 3.13.16, 3.14.0 – < 3.14.8, 3.15.0a1 – < 3.15.0rc3 3.10.22

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 pypy3 8.0.1+dfsg-1 —
Debian 14 python3.14 3.14.8-1 —
Debian 14 python3.15 3.15.0~rc3-1 —
Debian 13 pypy3 +1 No fix yet —
Debian 12 pypy3 No fix yet —
Debian 12 python3.11 3.11.2-6+deb12u9 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 python3.14 No fix yet —
Ubuntu 26.04 LTS python3.14 No fix yet —
Ubuntu 24.04 LTS python3.12 No fix yet —
Ubuntu 22.04 LTS python3.10 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 20.04 LTS python2.7 +2 No fix yet —
Ubuntu Pro 18.04 LTS python2.7 +3 No fix yet —
Ubuntu Pro 16.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 14.04 LTS python2.7 +2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 python3 +8 3.12.15-1.el10_2 RHSA-2026:77020
RHEL 10 python3.14 +13 3.14.8-1.el10_2 RHSA-2026:77018
RHEL 9 python3.12 +6 3.12.15-1.el9_8 RHSA-2026:77017
RHEL 9 python3.14 +13 3.14.8-1.el9_8 RHSA-2026:77021
RHEL 8 python3 +7 3.6.8-79.el8_10 RHSA-2026:85239
RHEL 8 python3.12 +7 3.12.15-2.el8_10 RHSA-2026:77028
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 python3.15 +13 3.15.0~rc2-1.1.hum1 RHSA-2026:74867

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 python3 +7 3.12.15-1.el10_2 ALSA-2026:77020
AlmaLinux 10 python3.14 +13 3.14.8-1.el10_2 ALSA-2026:77018
AlmaLinux 9 python3 +7 3.9.25-7.el9_8.6 ALSA-2026:89742
AlmaLinux 9 python3.12 +6 3.12.15-1.el9_8 ALSA-2026:77017
AlmaLinux 9 python3.14 +13 3.14.8-1.el9_8 ALSA-2026:77021
AlmaLinux 8 python3-idle +6 3.6.8-79.el8_10.alma.1 ALSA-2026:85239
AlmaLinux 8 python3.12 +7 3.12.15-2.el8_10 ALSA-2026:77028

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 python3.12 3.12.15-1.el10_2 RLSA-2026:77020
Rocky Linux 10 python3.14 3.14.8-1.el10_2 RLSA-2026:77018
Rocky Linux 9 python3.12 3.12.15-1.el9_8 RLSA-2026:77017
Rocky Linux 9 python3.14 3.14.8-1.el9_8 RLSA-2026:77021
Rocky Linux 9 python3.9 3.9.25-7.el9_8.6 RLSA-2026:89742
Rocky Linux 8 python3 3.6.8-79.el8_10.rocky.0 RLSA-2026:85239
Rocky Linux 8 python3.12 3.12.15-2.el8_10 RLSA-2026:77028

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 python 2.7.18-150000.139.1 SUSE-SU-2026:4919-1
SLES 15 SP7 python-base 2.7.18-150000.139.2 SUSE-SU-2026:4919-1
SLES 15 SP7 python311-core 3.11.17-150600.3.74.1 SUSE-SU-2026:4946-1
SLES 15 SP6 python311 +1 3.11.17-150600.3.74.1 SUSE-SU-2026:4946-1
SLES 15 SP6 python312 +1 3.12.15-150600.3.71.1 SUSE-SU-2026:4659-1
SLES 15 SP5 python311 +2 3.11.17-150400.9.105.1 SUSE-SU-2026:4809-1
SLES 15 SP4 python310 +1 3.10.22-150400.4.129.1 SUSE-SU-2026:4630-1
SLES 15 SP4 python311 +2 3.11.17-150400.9.105.1 SUSE-SU-2026:4809-1
SLES 12 SP5 python +2 2.7.18-33.96.1 SUSE-SU-2026:5137-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 3 python311 +1 3.11.17-150600.3.74.1 SUSE-SU-2026:4946-1
SLES 3 python313 +1 3.13.16-150700.4.61.1 SUSE-SU-2026:4941-1
SLES for SAP 15 SP6 python311 +1 3.11.17-150600.3.74.1 SUSE-SU-2026:4946-1
SLES for SAP 15 SP6 python312 +1 3.12.15-150600.3.71.1 SUSE-SU-2026:4659-1
SLES for SAP 15 SP5 python311 +2 3.11.17-150400.9.105.1 SUSE-SU-2026:4809-1
SLES for SAP 15 SP4 python310 +1 3.10.22-150400.4.129.1 SUSE-SU-2026:4630-1
SLES for SAP 15 SP4 python311 +2 3.11.17-150400.9.105.1 SUSE-SU-2026:4809-1
SLE Micro 6.1 python311 +1 3.11.17-slfo.1.1_1.1 SUSE-SU-2026:24280-1
SLE Micro 6.0 python311 +1 3.11.17-159998.1.1 SUSE-SU-2026:24325-1
SLE HPC 15 SP5 python311 +2 3.11.17-150400.9.105.1 SUSE-SU-2026:4809-1
SLE HPC 15 SP4 python310 +1 3.10.22-150400.4.129.1 SUSE-SU-2026:4630-1
SLE HPC 15 SP4 python311 +2 3.11.17-150400.9.105.1 SUSE-SU-2026:4809-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python310 3.10.22-1.1 openSUSE-SU-2026:12087-1
openSUSE Tumbleweed python311 3.11.17-1.1 openSUSE-SU-2026:12121-1
openSUSE Tumbleweed python312 3.12.15-1.1 openSUSE-SU-2026:12122-1
openSUSE Tumbleweed python313 3.13.16-1.1 openSUSE-SU-2026:12123-1
openSUSE Tumbleweed python314 3.14.8-1.1 openSUSE-SU-2026:12124-1
openSUSE Tumbleweed python315 3.15.0~rc3-1.1 openSUSE-SU-2026:12069-1
openSUSE Tumbleweed python316 3.16.0~a1-1.1 openSUSE-SU-2026:12477-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 python3 3.14.8-r0 —
Alpine v3.23 python3 3.12.15-r0 —
Alpine v3.22 python3 3.12.15-r0 —
Alpine v3.21 python3 3.12.15-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3.11 +6 3.11.17-1.amzn2023.0.1 ALAS2023-2026-3231
Amazon Linux 2023 python3.12 +6 3.12.15-2.amzn2023.0.1 ALAS2023-2026-3230
Amazon Linux 2023 python3.13 +8 3.13.16-1.amzn2023.0.1 ALAS2023-2026-3229
Amazon Linux 2023 python3.14 +13 3.14.8-1.amzn2023.0.1 ALAS2023-2026-3232

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python3 3.12.15-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 python3 +7 3.12.15-1.0.1.el10_2 ELSA-2026-77020
Oracle Linux 10 python3.14 +13 3.14.8-1.el10_2 ELSA-2026-77018
Oracle Linux 9 python3 +7 3.9.25-7.0.1.el9_8.6 ELSA-2026-89742
Oracle Linux 9 python3.12 +6 3.12.15-1.0.1.el9_8 ELSA-2026-77017
Oracle Linux 9 python3.14 +13 3.14.8-1.el9_8 ELSA-2026-77021
Oracle Linux 8 python3-idle +6 3.6.8-79.0.1.el8_10 ELSA-2026-85239
Oracle Linux 8 python3.12 +7 3.12.15-2.el8_10 ELSA-2026-77028

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 50

References