CVE-2026-19445
Description
A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.sni_callback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the server process or result in a call through a freed pointer. Servers that wrap their listening socket with a long-lived SSLContext are not affected. TLS clients are not affected.
Statement
This issue is rated Important. A remote unauthenticated client can trigger a server-side use-after-free when SNI callback code switches SSLSocket.context and drops the last reference to the original SSLContext, which can crash the process or call through a freed pointer (C:H/I:H/A:H). It is not Critical: exploitation requires a specific, non-default server pattern (per-connection or replaced SSLContext with sni_callback); the common pattern of wrapping the listening socket is explicitly not affected, so Attack Complexity is High. Red Hat ASLR, NX, and glibc heap hardening raise the bar for reliable code execution from the UAF but do not remove the crash/DoS impact, so Availability remains High.
Mitigation
Restrict Python TLS servers that use SSLContext.sni_callback to trusted clients. Keep a strong reference to every SSLContext that registers an SNI callback for the lifetime of the server so the original context cannot be garbage-collected while connections remain open. Prefer wrapping the listening socket with a long-lived SSLContext; that common pattern is not affected. Host heap allocator hardening increases the difficulty of turning the use-after-free into reliable code execution but does not prevent process crashes.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
