Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python 3 servers can crash via crafted TLS request
published 1 month ago
Summary
Python 3 versions before 3.12.15-1 may crash when a TLS client sends a specially crafted request that changes the certificate selection callback. This can happen on servers that create or replace SSL contexts per connection without keeping the original context alive. Keep a reference to each SSL context for the whole server lifetime to prevent the crash.
What to do
- Update python3 to version 3.12.15-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | – | python3 |
< 3.12.15-1 Fix: upgrade to 3.12.15-1
|
| Azure Linux:3 | azure | python3 | <= 3.12.14-2 |
Original advisory text
CVE-2026-19445 affecting package python3 for versions less than 3.12.15-1
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.
Mitigation: keep a reference to every SSLContext that sets sni_callback for
the lifetime of the server. TLS clients are not affected.
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.
Mitigation: keep a reference to every SSLContext that sets sni_callback for
the lifetime of the server. TLS clients are not affected.
References
Timeline
Published30 Sep 2026
Updated2 Nov 2026
First seen3 Oct 2026
Sources
AZL-105690 · OSV
Track software like this
Free during beta