{"answers":{"affected":"3 open source packages ship an affected version, including libpython, python and python-min.","exploited":"There is no known exploitation of CVE-2026-19445 in the wild and no public exploit code.","fix":"Upgrade libpython to a fixed version for your release line: 3.10.22, 3.11.17, 3.12.15 or 3.13.16.","what":"CVE-2026-19445 is a critical use after free vulnerability in CPython, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-19445 and fix it if it is affected.\n\nWhat it is: CVE-2026-19445 is a critical use after free vulnerability in CPython, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-19445 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- libpython (Bitnami): affected all versions; fixed in 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8\n- python (Bitnami): affected all versions; fixed in 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8\n- python-min (Bitnami): affected all versions; fixed in 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-19445/ (Markdown: https://insights.sbomify.com/CVE-2026-19445/index.md)","id":"CVE-2026-19445","markdown":"https://insights.sbomify.com/CVE-2026-19445/index.md","name":"CVE-2026-19445","record":{"aliases":["ALPINE-CVE-2026-19445","AZL-105690","BELL-CVE-2026-19445","BIT-libpython-2026-19445","BIT-python-2026-19445","BIT-python-min-2026-19445","CLSA-2026-1791413715","CLSA-2026-1791424578","CLSA-2026-1791425064","CLSA-2026-1791425564","CLSA-2026-1791433868","CLSA-2026-1791434571","CLSA-2026-1791434822","CLSA-2026-1791461442","CLSA-2026-1791521362","CLSA-2026-1791532612","CLSA-2026-1791559300","CLSA-2026-1791965784","CLSA-2026-1791967190","CLSA-2026-1792404857","DEBIAN-CVE-2026-19445","ECHO-aad0-2bf5-8da2","GHSA-7jvw-f348-84gq","MINI-4f6w-rg88-qgm7","MINI-797v-r5rr-hch2","MINI-9795-r28f-qw2v","MINI-gxwr-2ppw-f5rm","MINI-rm8c-jh7w-x3cp","PSF-2026-43","RHSA-2026:74867","ROOT-OS-DEBIAN-13-CVE-2026-19445","SUSE-SU-2026:4919-1","UBUNTU-CVE-2026-19445"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Python SSL library","requires_auth":"none","summary":"Remote attackers can crash servers or execute code via use-after-free in Python's SSL module when sni_callback switches contexts without retaining references.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"PSF","cpe":[],"cvss":{"score":9.2,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected.","ecosystems":["Bitnami","Red Hat:hummingbird:1","SUSE:Linux Enterprise Module for Package Hub 15 SP7"],"exploits":{"exploitdb":0,"first_seen":"2026-10-02","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-10-02T01:46:32Z","kind":"github_poc","ref":"https://github.com/abraxas/cve-2026-19445-sni-uaf","stars":0,"title":"CPython - Critical - SNI SSLContext UAF"}],"tier":"poc_unverified"},"has_fix":true,"headline":"Use-after-free of a server-side SSLContext when sni_callback switches contexts","id":"CVE-2026-19445","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":19,"n_references":10,"next":{"headline":"Vulnerabilities in IBM AIX and PowerVM VIOS","id":"CVE-2026-19446"},"packages":[{"ecosystem":"Bitnami","fixed":["3.10.22","3.11.17","3.12.15","3.13.16","3.14.8"],"introduced":["0","3.11.0","3.12.0","3.13.0","3.14.0"],"last_affected":[],"package":"libpython","purl":"pkg:bitnami/libpython","source":"BIT-libpython-2026-19445"},{"ecosystem":"Bitnami","fixed":["3.10.22","3.11.17","3.12.15","3.13.16","3.14.8"],"introduced":["0","3.11.0","3.12.0","3.13.0","3.14.0"],"last_affected":[],"package":"python","purl":"pkg:bitnami/python","source":"BIT-python-2026-19445"},{"ecosystem":"Bitnami","fixed":["3.10.22","3.11.17","3.12.15","3.13.16","3.14.8"],"introduced":["0","3.11.0","3.12.0","3.13.0","3.14.0"],"last_affected":[],"package":"python-min","purl":"pkg:bitnami/python-min","source":"BIT-python-min-2026-19445"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15","purl":"pkg:rpm/redhat/python3.15","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-debug","purl":"pkg:rpm/redhat/python3.15-debug","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-devel","purl":"pkg:rpm/redhat/python3.15-devel","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-freethreading","purl":"pkg:rpm/redhat/python3.15-freethreading","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-freethreading-debug","purl":"pkg:rpm/redhat/python3.15-freethreading-debug","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-freethreading-devel","purl":"pkg:rpm/redhat/python3.15-freethreading-devel","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-freethreading-idle","purl":"pkg:rpm/redhat/python3.15-freethreading-idle","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-freethreading-libs","purl":"pkg:rpm/redhat/python3.15-freethreading-libs","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-freethreading-test","purl":"pkg:rpm/redhat/python3.15-freethreading-test","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-freethreading-tkinter","purl":"pkg:rpm/redhat/python3.15-freethreading-tkinter","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-idle","purl":"pkg:rpm/redhat/python3.15-idle","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-libs","purl":"pkg:rpm/redhat/python3.15-libs","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-test","purl":"pkg:rpm/redhat/python3.15-test","source":"RHSA-2026:74867"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.15.0~rc2-1.1.hum1"],"introduced":["0"],"last_affected":[],"package":"python3.15-tkinter","purl":"pkg:rpm/redhat/python3.15-tkinter","source":"RHSA-2026:74867"},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","fixed":["2.7.18-150000.139.1"],"introduced":["0"],"last_affected":[],"package":"python","purl":"pkg:rpm/suse/python\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","source":"SUSE-SU-2026:4919-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","fixed":["2.7.18-150000.139.2"],"introduced":["0"],"last_affected":[],"package":"python-base","purl":"pkg:rpm/suse/python-base\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","source":"SUSE-SU-2026:4919-1"}],"prev":{"headline":"Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes","id":"CVE-2026-19444"},"products":["CPython"],"published":"2026-09-30","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"SUSE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-03","vendors":["Python Software Foundation"]},"summary":"Remote attackers can crash servers or execute code via use-after-free in Python's SSL module when sni_callback switches contexts without retaining references.","url":"https://insights.sbomify.com/CVE-2026-19445/"}