Vulnerabilities

TI-2026-15902 CVE-2026-19553 · GHSA-xx9w-qm94-hghj

SSLContext.wrap_bio() missing validation of server_hostname parameter

LOW 36

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00547 Published 2026-09-30 Partial fix · 3.10.22, 3.11.17 +4 CWE-297

TI-2026-15850 CVE-2026-19445 · GHSA-7jvw-f348-84gq

Use-after-free of a server-side SSLContext when sni_callback switches contexts

MEDIUM 40

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server nam…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00524 Published 2026-09-30 Partial fix · 3.10.22, 3.11.17 +4 CWE-416

Vulnerabilities

Filters

SSLContext.wrap_bio() missing validation of server_hostname parameter

Use-after-free of a server-side SSLContext when sni_callback switches contexts