Remote Code Execution Vulnerability in Python's SSL Module Affecting Python Software Foundation
CVE-2026-19445

9.2CRITICAL

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
30 September 2026

What is CVE-2026-19445?

A vulnerability exists in Python's SSL module where a remote, unauthenticated TLS client can cause a server crash or invoke a call through a freed pointer. This occurs when the sni_callback function utilizes a different context for SSLSocket.context without ensuring the original ssl.SSLContext remains in memory. Servers that generate a new SSLContext for each connection or replace it while connections are still active are particularly vulnerable. Mitigating this issue requires maintaining a reference to every SSLContext linked to sni_callback for the server's duration.

Affected Version(s)

CPython 0 < 3.16.0

References

https://github.com/python/cpython/pull/158504
patch
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory
https://github.com/python/cpython/issues/156293
issue-tracking

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gregory P. Smith (https://github.com/gpshead)
Seth Larson (https://github.com/sethmlarson)
Bénédikt Tran (https://github.com/picnixz)
.