CVE-2026-19445

/// Technical description

A remote, unauthenticated TLS client can make a server crash or call

through a freed pointer if its sni_callback assigns a different context to

SSLSocket.context (the documented way to select a certificate per server

name) and nothing else keeps the original ssl.SSLContext alive. Typical

cases are servers that create an SSLContext per connection or replace it

while connections are open; servers that wrap their listening socket with

it are not affected.

Mitigation: keep a reference to every SSLContext that sets sni_callback for

the lifetime of the server. TLS clients are not affected.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References