Bug 2544138 (CVE-2026-19445) - CVE-2026-19445 python: Use-after-free of a server-side SSLContext when sni_callback switches contexts
Summary: CVE-2026-19445 python: Use-after-free of a server-side SSLContext when sni_ca...
Keywords:
Status: NEW
Alias: CVE-2026-19445
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2545931 2545939 2545941 2545932 2545933 2545935 2545936 2545937 2545938 2545940
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-30 16:47 UTC by OSIDB Bzimport
Modified: 2026-10-19 16:30 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:77017 0 None None None 2026-10-08 08:17:38 UTC
Red Hat Product Errata RHSA-2026:77018 0 None None None 2026-10-08 08:40:32 UTC
Red Hat Product Errata RHSA-2026:77020 0 None None None 2026-10-08 09:32:15 UTC
Red Hat Product Errata RHSA-2026:77021 0 None None None 2026-10-08 08:15:11 UTC
Red Hat Product Errata RHSA-2026:77028 0 None None None 2026-10-07 03:09:48 UTC
Red Hat Product Errata RHSA-2026:85239 0 None None None 2026-10-19 16:30:01 UTC

Description OSIDB Bzimport 2026-09-30 16:47:20 UTC 
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.


Mitigation: keep a reference to every SSLContext that sets sni_callback for
the lifetime of the server. TLS clients are not affected.
Comment 1 Jon Orris 2026-10-07 03:09:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:77028 https://access.redhat.com/errata/RHSA-2026:77028
Comment 2 Jon Orris 2026-10-08 08:15:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:77021 https://access.redhat.com/errata/RHSA-2026:77021
Comment 3 Jon Orris 2026-10-08 08:17:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:77017 https://access.redhat.com/errata/RHSA-2026:77017
Comment 4 Jon Orris 2026-10-08 08:40:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:77018 https://access.redhat.com/errata/RHSA-2026:77018
Comment 5 Jon Orris 2026-10-08 09:32:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:77020 https://access.redhat.com/errata/RHSA-2026:77020
Comment 6 Jon Orris 2026-10-19 16:30:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:85239 https://access.redhat.com/errata/RHSA-2026:85239
Note You need to log in before you can comment on or make changes to this bug.