UnratedFix available
Fix CVE(s): CVE-2026-19445, CVE-2026-4786
Type: advisorySources: OSV
* SECURITY UPDATE: use-after-free in the ssl servername (SNI) callback - debian/patches/CVE-2026-19445.patch: take the SSLContext from the connection and hold references to it and to the callback while the callback runs, instead of using the borrowed pointer registered with OpenSSL, and unregister the callback when the context is deallocated, in Modules/_ssl.c, so a servername callback that switches the connection to another context can no longer make the server call through a freed SSLContext. - CVE-2026-19445
- Products
- idle-python3.5, libpython3.5, libpython3.5-dev, libpython3.5-minimal, libpython3.5-stdlib, libpython3.5-testsuite, python3.5, python3.5-dev, python3.5-doc, python3.5-examples, python3.5-minimal, python3.5-venv
- Affected versions
- Not specified
- Fixed versions
- 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
- CVEs
- CVE-2026-19445, CVE-2026-4786
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:40 UTC · Revision 1
Source evidence
* SECURITY UPDATE: use-after-free in the ssl servername (SNI) callback - debian/patches/CVE-2026-19445.patch: take the SSLContext from the connection and hold references to it and to the callback while the callback runs, instead of using the borrowed pointer registered with OpenSSL, and unregister the callback when the context is deallocated, in Modules/_ssl.c, so a servername callback that switches the connection to another context can no longer make the server call through a freed SSLContext. - CVE-2026-19445
osv:CLSA-2026-1791803568
idle-python3.5
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
libpython3.5
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
libpython3.5-dev
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
libpython3.5-minimal
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
libpython3.5-stdlib
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
libpython3.5-testsuite
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
python3.5
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
python3.5-dev
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
python3.5-doc
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
python3.5-examples
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
python3.5-minimal
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
python3.5-venv
Fixed versions: 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31
Complete source record
{
"id": "1eda2c60caabf5c9a754004bb9b70372b5ed56c0c5e2b8475a50ee873d6da29b",
"url": "https://osv.dev/vulnerability/CLSA-2026-1791803568",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fix CVE(s): CVE-2026-19445, CVE-2026-4786",
"summary": "* SECURITY UPDATE: use-after-free in the ssl servername (SNI) callback - debian/patches/CVE-2026-19445.patch: take the SSLContext from the connection and hold references to it and to the callback while the callback runs, instead of using the borrowed pointer registered with OpenSSL, and unregister the callback when the context is deallocated, in Modules/_ssl.c, so a servername callback that switches the connection to another context can no longer make the server call through a freed SSLContext. - CVE-2026-19445",
"evidence": "osv:CLSA-2026-1791803568",
"products": [
{
"name": {
"value": "idle-python3.5",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.5",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.5-dev",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.5-minimal",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.5-stdlib",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.5-testsuite",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.5",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.5-dev",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.5-doc",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.5-examples",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.5-minimal",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.5-venv",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1791803568",
"aliases": [
"CLSA-2026-1791803568"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "idle-python3.5",
"purl": "pkg:deb/tuxcare/idle-python3.5?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "libpython3.5",
"purl": "pkg:deb/tuxcare/libpython3.5?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "libpython3.5-dev",
"purl": "pkg:deb/tuxcare/libpython3.5-dev?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "libpython3.5-minimal",
"purl": "pkg:deb/tuxcare/libpython3.5-minimal?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "libpython3.5-stdlib",
"purl": "pkg:deb/tuxcare/libpython3.5-stdlib?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "libpython3.5-testsuite",
"purl": "pkg:deb/tuxcare/libpython3.5-testsuite?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "python3.5",
"purl": "pkg:deb/tuxcare/python3.5?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "python3.5-dev",
"purl": "pkg:deb/tuxcare/python3.5-dev?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "python3.5-doc",
"purl": "pkg:deb/tuxcare/python3.5-doc?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "python3.5-examples",
"purl": "pkg:deb/tuxcare/python3.5-examples?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "python3.5-minimal",
"purl": "pkg:deb/tuxcare/python3.5-minimal?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:3.5.2-2ubuntu0~16.04.13+tuxcare.els31"
}
]
}
],
"package": {
"name": "python3.5-venv",
"purl": "pkg:deb/tuxcare/python3.5-venv?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791803568.json"
}
}
],
"modified": "2026-10-26T09:32:02.673222110Z",
"provider": "osv",
"upstream": [
"CVE-2026-19445",
"CVE-2026-4786"
],
"references": [
"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1791803568.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19445",
"https://nvd.nist.gov/vuln/detail/CVE-2026-4786"
]
},
"related_cves": [
{
"value": "CVE-2026-19445",
"evidence": "/upstream"
},
{
"value": "CVE-2026-4786",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 449464,
"published_at": "2026-10-19T20:53:46+00:00"
}