CVE-2026-19445
python-min: Use After Free (CVE-2026-19445)
Description
A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.sni_callback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the server process or result in a call through a freed pointer. Servers that wrap their listening socket with a long-lived SSLContext are not affected. TLS clients are not affected.
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
3.11.03.12.03.13.03.14.0Metrics
Show all metrics
Weakness classes (CWE)
CWE-416Variant
Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
cwe.mitre.org →
References & sources
- https://github.com/python/cpython/pull/158504patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/vendor-advisory
- https://github.com/python/cpython/issues/156293issue-tracking
- http://www.openwall.com/lists/oss-security/2026/09/30/17
- https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053dpatch
- https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552bpatch
- https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7patch
- https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698patch
- https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2cpatch
- https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8fix
- https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24bfix
- https://nvd.nist.gov/vuln/detail/CVE-2026-19445web
Reanalysis & status changes
Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.
- CVE Modified2026-10-03 01:17 UTC· cna@python.org
- Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/19xxx/CVE-2026-19445.json">CVE-2026-19445</a>
- CVE Modified2026-10-02 01:16 UTC· cna@python.org
- Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/19xxx/CVE-2026-19445.json">CVE-2026-19445</a>
- CVE Modified2026-10-01 01:16 UTC· cna@python.org
- Reference: https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8
- Reference: https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b
- CVE Modified2026-09-30 23:17 UTC· cna@python.org
- Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/19xxx/CVE-2026-19445.json">CVE-2026-19445</a>
- CVE Modified2026-09-30 21:17 UTC· cna@python.org
- Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/19xxx/CVE-2026-19445.json">CVE-2026-19445</a>
- Reference: https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d
- Reference: https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b
- Reference: https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7