CVE-2026-19445 Use-after-free of a server-side SSLContext when sni_callback switches contexts
Remote attackers can crash servers or execute code via use-after-free in Python's SSL module when sni_callback switches contexts without retaining references.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19445?
CVE-2026-19445 is a critical use after free vulnerability in CPython, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected.
Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
Weakness: CWE-416
Which versions are affected by CVE-2026-19445?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8 |
python Bitnami | All versions | 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8 |
python-min Bitnami | All versions | 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8 |
Linux distribution packages (16)
python3.15 Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-debug Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-devel Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-freethreading Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-freethreading-debug Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-freethreading-devel Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-freethreading-idle Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-freethreading-libs Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-freethreading-test Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-freethreading-tkinter Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-idle Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-libs Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-test Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python3.15-tkinter Red Hat:hummingbird:1 | All versions | 0:3.15.0~rc2-1.1.hum1 |
python SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 2.7.18-150000.139.1 |
python-base SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 2.7.18-150000.139.2 |
How do I fix CVE-2026-19445?
Upgrade libpython to a fixed version for your release line: 3.10.22, 3.11.17, 3.12.15 or 3.13.16.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-19445 being exploited?
There is no known exploitation of CVE-2026-19445 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2026-19445, AZL-105690, BELL-CVE-2026-19445, BIT-libpython-2026-19445, BIT-python-2026-19445, BIT-python-min-2026-19445 and 27 more.