Read the docs
TI-2026-15850 Aliases CVE-2026-19445GHSA-7jvw-f348-84gq

Use-after-free of a server-side SSLContext when sni_callback switches contexts

Priority MEDIUM 40CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · Low
Fix status
Partial Red Hat: 21 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.

Why it matters now

EPSS 0.00524 44th percentileScored 2026-11-07
Fix Partial CPython (Python Software Foundation): 3.10.22, 3.11.17, 3.12.15 +3Red Hat: 13 advisoriesRed Hat: 21 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Python Software FoundationCPythonbefore 3.10.22; 3.11.0 to before 3.11.17; 3.12.0 to before 3.12.15; 3.13.0 to before 3.13.16; 3.14.0 to before 3.14.8; 3.15.0a1 to before 3.15.0rc33.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8, 3.15.0rc3Patch availableCNA
  • CPython VendorPython Software Foundation Affected before 3.10.22; 3.11.0 to before 3.11.17; 3.12.0 to before 3.12.15; 3.13.0 to before 3.13.16; 3.14.0 to before 3.14.8; 3.15.0a1 to before 3.15.0rc3 Fixed in 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8, 3.15.0rc3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*——python-pillow
  • cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions — — ·python-pillow

Remediation

  • Fix · CNA CPython (Python Software Foundation) Fixed in 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8, 3.15.0rc3

Red Hat 13 advisories

  • RHSA-2026:95082 Released 2026-11-04 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) platform-python-3.6.8-39.el8_4.13, platform-python-debug-3.6.8-39.el8_4.13, platform-python-devel-3.6.8-39.el8_4.13 +3
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.13, platform-python-debug-3.6.8-39.el8_4.13, platform-python-devel-3.6.8-39.el8_4.13 +3
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) platform-python-3.6.8-39.el8_4.13, python3-3.6.8-39.el8_4.13, python3-libs-3.6.8-39.el8_4.13 +1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.13, python3-3.6.8-39.el8_4.13, python3-libs-3.6.8-39.el8_4.13 +1
  • RHSA-2026:94802 Released 2026-11-04 · Red Hat rating Critical
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:94443 Released 2026-11-03 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) platform-python-3.6.8-47.el8_6.16, platform-python-debug-3.6.8-47.el8_6.16, platform-python-devel-3.6.8-47.el8_6.16 +3
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) platform-python-3.6.8-47.el8_6.16, platform-python-debug-3.6.8-47.el8_6.16, platform-python-devel-3.6.8-47.el8_6.16 +3
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) platform-python-3.6.8-47.el8_6.16, python3-3.6.8-47.el8_6.16, python3-libs-3.6.8-47.el8_6.16 +1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) platform-python-3.6.8-47.el8_6.16, python3-3.6.8-47.el8_6.16, python3-libs-3.6.8-47.el8_6.16 +1
Show 10 more Red Hat advisories
  • RHSA-2026:89742 Released 2026-10-26 · Red Hat rating Important
    python3.9 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.25-7.el9_8.6, python3-devel-3.9.25-7.el9_8.6, python3-tkinter-3.9.25-7.el9_8.6
    • Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.25-7.el9_8.6, python3-libs-3.9.25-7.el9_8.6, python3.9-3.9.25-7.el9_8.6
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3-3.9.25-7.el9_8.6, python3-debug-3.9.25-7.el9_8.6, python3-idle-3.9.25-7.el9_8.6 +2
  • RHSA-2026:87400 Released 2026-10-21 · Red Hat rating Important
    Red Hat Cost Management On-Premise container image update
    • Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10
  • RHSA-2026:85239 Released 2026-10-19 · Red Hat rating Important
    python3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-79.el8_10, platform-python-debug-3.6.8-79.el8_10, platform-python-devel-3.6.8-79.el8_10 +3
    • Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-79.el8_10, python3-3.6.8-79.el8_10, python3-libs-3.6.8-79.el8_10 +1
  • RHSA-2026:82939 Released 2026-10-14 · Red Hat rating Important
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:77020 Released 2026-10-08 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python-unversioned-command-3.12.15-1.el10_2, python3-devel-3.12.15-1.el10_2, python3-tkinter-3.12.15-1.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) python3-3.12.15-1.el10_2, python3-libs-3.12.15-1.el10_2, python3.12-3.12.15-1.el10_2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-debug-3.12.15-1.el10_2, python3-idle-3.12.15-1.el10_2, python3-test-3.12.15-1.el10_2
  • RHSA-2026:77017 Released 2026-10-08 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-3.12.15-1.el9_8, python3.12-devel-3.12.15-1.el9_8, python3.12-libs-3.12.15-1.el9_8 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.12-3.12.15-1.el9_8, python3.12-debug-3.12.15-1.el9_8, python3.12-idle-3.12.15-1.el9_8 +2
  • RHSA-2026:77018 Released 2026-10-08 · Red Hat rating Important
    python3.14 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python3.14-3.14.8-1.el10_2, python3.14-devel-3.14.8-1.el10_2, python3.14-libs-3.14.8-1.el10_2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3.14-debug-3.14.8-1.el10_2, python3.14-freethreading-3.14.8-1.el10_2, python3.14-freethreading-debug-3.14.8-1.el10_2 +7
  • RHSA-2026:77021 Released 2026-10-08 · Red Hat rating Important
    python3.14 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.14-3.14.8-1.el9_8, python3.14-devel-3.14.8-1.el9_8, python3.14-libs-3.14.8-1.el9_8 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.14-3.14.8-1.el9_8, python3.14-debug-3.14.8-1.el9_8, python3.14-freethreading-3.14.8-1.el9_8 +9
  • RHSA-2026:77028 Released 2026-10-07 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-3.12.15-2.el8_10, python3.12-devel-3.12.15-2.el8_10, python3.12-libs-3.12.15-2.el8_10 +2
    • Red Hat Enterprise Linux CRB (v. 8) python3.12-3.12.15-2.el8_10, python3.12-debug-3.12.15-2.el8_10, python3.12-idle-3.12.15-2.el8_10 +2
  • RHSA-2026:74867 Released 2026-10-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python3.15-3.15.0~rc2-1.1.hum1@aarch64, python3.15-3.15.0~rc2-1.1.hum1@src, python3.15-3.15.0~rc2-1.1.hum1@x86_64 +26

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Python Software Foundation CPython 3.10.22, 3.11.17 and 4 more versions

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-15902 SSLContext.wrap_bio() missing validation of server_hostname parameterPriority LOW 36
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix planned: Out of support scope
Red Hat OpenShift AI (RHOAI)Affected—
Red Hat Cost Management On-Premise 1Fixed RHSA-2026:87400
Red Hat Discovery 2Fixed RHSA-2026:94802
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:77018, RHSA-2026:77020
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:77028, RHSA-2026:85239
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:77017, RHSA-2026:77021, RHSA-2026:89742
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:95082
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:94443
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:95082
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:94443
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:77020
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:85239
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:89742
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:95082
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:94443
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:95082
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:94443
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:77028
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:77018, RHSA-2026:77020
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:77017, RHSA-2026:77021, RHSA-2026:89742
Red Hat Hardened ImagesFixed RHSA-2026:74867
Red Hat Update Infrastructure 5Fixed RHSA-2026:82939
Not affected: 5 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Hardened Images
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19445
  2. 2026-10-03 Alias added: GHSA-7jvw-f348-84gq
  3. 2026-10-06 Fix available: RHSA-2026:74867 · Red Hat
  4. 2026-10-06 Fix available: Red Hat Hardened Images · Red Hat
  5. 2026-10-06 CVSS score added · Red Hat
  6. 2026-10-07 Fix available: RHSA-2026:77028 · Red Hat
  7. 2026-10-07 Fix available: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · Red Hat
  8. 2026-10-08 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) +1 · Red Hat
  9. 2026-10-09 Fix available: RHSA-2026:77021 · Red Hat
  10. 2026-10-09 Fix available: RHSA-2026:77018 · Red Hat
  11. 2026-10-09 Fix available: RHSA-2026:77017 · Red Hat
  12. 2026-10-09 Fix available: RHSA-2026:77020 · Red Hat
  13. 2026-10-09 Fix available: Red Hat Enterprise Linux BaseOS (v. 10) · Red Hat
  14. 2026-10-13 Affected versions changed · Red Hat
  15. 2026-10-16 Fix available: RHSA-2026:82939 · Red Hat
  16. 2026-10-16 Fix available: Red Hat Update Infrastructure 5 · Red Hat
  17. 2026-10-20 Fix available: RHSA-2026:85239 · Red Hat
  18. 2026-10-20 Fix available: Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat
  19. 2026-10-22 Fix available: RHSA-2026:87400 · Red Hat
  20. 2026-10-23 Fix available: Red Hat Cost Management On-Premise 1 · Red Hat
  21. 2026-10-26 Fix available: RHSA-2026:89742 · Red Hat
  22. 2026-10-26 Fix available: Red Hat Enterprise Linux BaseOS (v. 9) · Red Hat
  23. 2026-11-03 Fix available: RHSA-2026:94443 · Red Hat
  24. 2026-11-03 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6), Red Hat Enterprise Linux BaseOS AUS (v.8.6) +1 · Red Hat
  25. 2026-11-04 Fix available: RHSA-2026:94802 · Red Hat
  26. 2026-11-04 Fix available: Red Hat Discovery 2 · Red Hat
  27. 2026-11-04 Fix available: RHSA-2026:95082 · Red Hat
  28. 2026-11-04 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4), Red Hat Enterprise Linux BaseOS AUS (v.8.4) +1 · Red Hat
  29. 2026-11-06 Affected versions changed · Red Hat

References

Patch 8

Advisory 1

Other 1

  • TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
  • TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
  • TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
  • TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
  • TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
  • TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences