Search: CVE-2026-19445

CVE-2026-19445 is a critical use-after-free vulnerability (CWE-416) in the Python CPython implementation affecting TLS servers that use the sni_callback to assign different SSL contexts per connection without retaining references to the original SSLContext. This can cause server crashes or calls through freed pointers. TLS clients are not affected. The vulnerability impacts multiple CPython versions prior to specific patched releases. Mitigation involves keeping a reference to every SSLContext that sets sni_callback for the server's lifetime.