Red Hat Security Advisory

RHSA-2026:77021

python3.14 security update

Released 2026-10-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) python3.14-3.14.8-1.el9_8, python3.14-devel-3.14.8-1.el9_8, python3.14-libs-3.14.8-1.el9_8 +1
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.14-3.14.8-1.el9_8, python3.14-debug-3.14.8-1.el9_8, python3.14-freethreading-3.14.8-1.el9_8 +9

Fixes 2 records

TI-2026-15850 CVE-2026-19445 · GHSA-7jvw-f348-84gq

Use-after-free of a server-side SSLContext when sni_callback switches contexts

MEDIUM 40

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server nam…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00524 Published 2026-09-30 Partial fix · 3.10.22, 3.11.17 +4 CWE-416

TI-2026-15902 CVE-2026-19553 · GHSA-xx9w-qm94-hghj

SSLContext.wrap_bio() missing validation of server_hostname parameter

LOW 36

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00547 Published 2026-09-30 Partial fix · 3.10.22, 3.11.17 +4 CWE-297