Unrated
Security advisory
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-19445
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 12:32 UTC · Revision 1
Source evidence
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
osv:PSF-2026-43
Complete source record
{
"id": "80bc9ace9b2496fa758132ab41c22b12768f0d46218e012a15e38ca97d190d8f",
"url": "https://osv.dev/vulnerability/PSF-2026-43",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "PSF-2026-43",
"summary": "A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.",
"evidence": "osv:PSF-2026-43",
"products": [],
"severity": "unknown",
"structured": {
"id": "PSF-2026-43",
"aliases": [
"BIT-libpython-2026-19445",
"BIT-python-2026-19445",
"BIT-python-min-2026-19445",
"CVE-2026-19445",
"PSF-2026-43"
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/python/cpython",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "34a53dce8174da2fceb12fe084a4def02a10053d"
},
{
"fixed": "46133cd57d309652139ada74014aca7665ac552b"
},
{
"fixed": "63fab143d94cafae71850831acfb52041ba44af7"
},
{
"fixed": "cd7e51e7d4563866fbaa1e2521ae69b45daf3698"
},
{
"fixed": "d8717ed01717a9641686e6e6f83f0ab8af235e2c"
},
{
"fixed": "b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8"
},
{
"fixed": "ec44b5a3258cbda947d5e07242ee562ed05ef24b"
}
]
}
],
"versions": [
"v3.15.0rc2",
"v3.11.16",
"v3.10.21",
"v3.12.14",
"v3.13.15",
"v3.14.7",
"v3.15.0rc1",
"v3.15.0b4",
"v3.15.0b3",
"v3.13.14",
"v3.14.6",
"v3.15.0b2",
"v3.14.5",
"v3.15.0b1",
"v3.14.5rc1",
"v3.13.13",
"v3.14.4",
"v3.15.0a8",
"v3.15.0a7",
"v3.12.13",
"v3.10.20",
"v3.11.15",
"v3.15.0a6",
"v3.13.12",
"v3.14.3",
"v3.15.0a5",
"v3.15.0a4",
"v3.15.0a3",
"v3.14.2",
"v3.13.11",
"v3.13.10",
"v3.14.1",
"v3.15.0a2",
"v3.15.0a1",
"v3.13.8",
"v3.11.14",
"v3.10.19",
"v3.12.12",
"v3.14.0",
"v3.14.0rc3",
"v3.13.7",
"v3.14.0rc2",
"v3.13.6",
"v3.14.0rc1",
"v3.14.0b4",
"v3.14.0b3",
"v3.13.5",
"v3.13.4",
"v3.11.13",
"v3.10.18",
"v3.12.11",
"v3.14.0b2",
"v3.14.0b1",
"v3.13.3",
"v3.11.12",
"v3.12.10",
"v3.14.0a7",
"v3.10.17",
"v3.14.0a6",
"v3.14.0a5",
"v3.13.2",
"v3.12.9",
"v3.14.0a4",
"v3.14.0a3",
"v3.13.1",
"v3.12.8",
"v3.10.16",
"v3.11.11",
"v3.14.0a2",
"v3.14.0a1",
"v3.13.0",
"v3.13.0rc3",
"v3.12.7",
"v3.11.10",
"v3.10.15",
"v3.13.0rc2",
"v3.12.6",
"v3.12.5",
"v3.13.0rc1",
"v3.13.0b4",
"v3.13.0b3",
"v3.12.4",
"v3.13.0b2",
"v3.13.0b1",
"v3.13.0a6",
"v3.12.3",
"v3.11.9",
"v3.10.14",
"v3.13.0a5",
"v3.13.0a4",
"v3.12.2",
"v3.11.8",
"v3.13.0a3",
"v3.12.1",
"v3.11.7",
"v3.13.0a2",
"v3.13.0a1",
"v3.11.6",
"v3.12.0",
"v3.12.0rc3",
"v3.12.0rc2",
"v3.11.5",
"v3.10.13",
"v3.12.0rc1",
"v3.12.0b4",
"v3.12.0b3",
"v3.11.4",
"v3.10.12",
"v3.12.0b2",
"v3.12.0b1",
"v3.10.11",
"v3.11.3",
"v3.12.0a7",
"v3.12.0a6",
"v3.10.10",
"v3.11.2",
"v3.12.0a5",
"v3.12.0a4",
"v3.12.0a3",
"v3.10.9",
"v3.11.1",
"v3.12.0a2",
"v3.12.0a1",
"v3.11.0rc2",
"v3.10.8",
"v3.10.7",
"v3.11.0rc1",
"v3.10.6",
"v3.11.0b5",
"v3.11.0b4",
"v3.10.5",
"v3.11.0b3",
"v3.11.0b2",
"v3.11.0b1",
"v3.11.0a7",
"v3.10.4",
"v3.10.3",
"v3.11.0a6",
"v3.11.0a5",
"v3.11.0a4",
"v3.10.2",
"v3.11.0a3",
"v3.10.1",
"v3.10.0rc2",
"v3.10.0rc1",
"v3.10.0b4",
"v3.10.0b3",
"v3.10.0b2",
"v3.10.0b1",
"v3.10.0a7",
"v3.10.0a1",
"v3.9.0a2",
"v3.7.0a2",
"v3.6.0b1",
"v3.6.0a3",
"v3.5.0b1",
"v3.5.0a4",
"v3.5.0a3",
"v3.5.0a2",
"v3.5.0a1",
"v3.4.0b3",
"v3.4.0b2",
"v3.4.0b1",
"v3.4.0a4",
"v3.4.0a3",
"v3.4.0a2",
"v3.4.0a1",
"v3.3.0rc3",
"v3.3.0rc2",
"v3.3.0rc1",
"v3.3.0b2",
"v3.3.0b1",
"v3.3.0a4",
"v3.3.0a3",
"v3.3.0a2",
"v3.2rc3",
"v3.2rc2",
"v3.2rc1",
"v3.2b2",
"v3.2b1",
"v3.2a4",
"v3.2a3",
"v3.2a2",
"v3.2a1",
"v3.1",
"v3.1rc2",
"v3.1rc1",
"v3.1b1",
"v3.1a2",
"v3.1a1",
"v3.0rc3",
"v3.0rc2",
"v3.0rc1",
"v3.0b3",
"v3.0b2",
"v3.0b1",
"v3.0a5",
"v3.0a4",
"v3.0a3",
"v3.0a2",
"v3.0a1",
"v2.4",
"v2.4c1",
"v2.4b2",
"v2.4b1",
"v2.4a3",
"v2.4a2",
"v2.4a1",
"v2.3c2",
"v2.3c1",
"v2.2a3",
"v2.1",
"v2.1c2",
"v2.1c1",
"v2.1b2",
"v2.1b1",
"v2.1a2",
"v2.1a1",
"v2.0",
"v2.0c1",
"v2.0b2",
"v2.0b1",
"v1.6a2",
"v1.6a1",
"v1.5.2",
"v1.5.2c1",
"v1.5.2b2",
"v1.5.2b1",
"v1.5.2a2",
"v1.5.2a1",
"v1.5.1",
"v1.5",
"v1.5b2",
"v1.5b1",
"v1.5a4",
"v1.5a3",
"v1.5a2",
"v1.5a1",
"v1.4",
"v1.4b3",
"v1.4b2",
"v1.4b1",
"v1.3",
"v1.3b1",
"v1.2",
"v1.2b4",
"v1.2b3",
"v1.2b2",
"v1.2b1",
"v1.1.1",
"v1.1",
"v1.0.2",
"v1.0.1",
"v0.9.9",
"v0.9.8"
],
"database_specific": {
"source": "https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-43.json",
"vanir_signatures": [
{
"id": "PSF-2026-43-0872e0f6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"170476158416706744586282681779594726728",
"86476036914261173237508971174908544909",
"147425604329974179478204576385557413999",
"265690918346457980902501841814291472715",
"273982479869105383383500484832531424386",
"334634295412094945717228744716843989112",
"213620177722666314926856250473775789039",
"224474726826977036013941710863750715028",
"200965794566678960594364239147360223447",
"233426238470539158223951544642444436747",
"17122538462444063396004217866118950023",
"66573130367576461537947877989119307702",
"164007464104000084490636290708140145743",
"170443041069617498429182177581520475746",
"265691513509834204364860423795396781169",
"72469237269978034715513691429457912948",
"315456300782888827521076910992583209514",
"135636683511366361069907664530672045358",
"103205685760401644501851548964230611853",
"47520192251176820160974047737879602159",
"202472072711394737516678089181471628510",
"296911923594769044067645858500754066934",
"170930553121445108863477993426532935479",
"107857131919295171175990105703143114775",
"215878207680712425617714572176854254172",
"240706634002122547759684249000340367293",
"190013626958382564350712737622791187687",
"68660693758850873590704649074801451386",
"186470493458987757460490023369540254262",
"16857990377574565265995852588766344151",
"321368479543678980352146348131507804636",
"228914987871085262798083377034909088167",
"27044961477169108875234682282299655703",
"64828062720284094759206461151608573866",
"209885499725972239150228524220084795004",
"260109408203602839961906961413685969670",
"258284887827698492159567648883576774872",
"165576719922589348124044523768295957262",
"115828378121330090540176189564960727489",
"232143437476800509104357162685104346039",
"239446528826220049469262264684784563171",
"183225861499239276108178405934476583130",
"262881091645503970004104101863897337789",
"122838324552460613522635150517682423329",
"278491848832606031486833309611652744368",
"333561987953628111204678711502779305118",
"228696587423872517241141060577844354623"
]
},
"source": "https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b",
"target": {
"file": "Modules/_ssl.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-08d313e1",
"digest": {
"length": 268,
"function_hash": "32533656948483893404282435038434411260"
},
"source": "https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7",
"target": {
"file": "Modules/_ssl.c",
"function": "context_dealloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-1224929b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"170476158416706744586282681779594726728",
"86476036914261173237508971174908544909",
"147425604329974179478204576385557413999",
"265690918346457980902501841814291472715",
"273982479869105383383500484832531424386",
"334634295412094945717228744716843989112",
"213620177722666314926856250473775789039",
"224474726826977036013941710863750715028",
"200965794566678960594364239147360223447",
"233426238470539158223951544642444436747",
"17122538462444063396004217866118950023",
"66573130367576461537947877989119307702",
"164007464104000084490636290708140145743",
"170443041069617498429182177581520475746",
"265691513509834204364860423795396781169",
"72469237269978034715513691429457912948",
"315456300782888827521076910992583209514",
"135636683511366361069907664530672045358",
"103205685760401644501851548964230611853",
"47520192251176820160974047737879602159",
"202472072711394737516678089181471628510",
"296911923594769044067645858500754066934",
"170930553121445108863477993426532935479",
"107857131919295171175990105703143114775",
"215878207680712425617714572176854254172",
"240706634002122547759684249000340367293",
"190013626958382564350712737622791187687",
"68660693758850873590704649074801451386",
"186470493458987757460490023369540254262",
"16857990377574565265995852588766344151",
"321368479543678980352146348131507804636",
"228914987871085262798083377034909088167",
"27044961477169108875234682282299655703",
"64828062720284094759206461151608573866",
"209885499725972239150228524220084795004",
"260109408203602839961906961413685969670",
"258284887827698492159567648883576774872",
"165576719922589348124044523768295957262",
"115828378121330090540176189564960727489",
"232143437476800509104357162685104346039",
"239446528826220049469262264684784563171",
"183225861499239276108178405934476583130",
"262881091645503970004104101863897337789",
"38593107192127031498014302091740162928",
"191841778618333248935672586938830816236",
"333561987953628111204678711502779305118",
"228696587423872517241141060577844354623"
]
},
"source": "https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8",
"target": {
"file": "Modules/_ssl.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-14ccff3b",
"digest": {
"length": 268,
"function_hash": "32533656948483893404282435038434411260"
},
"source": "https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d",
"target": {
"file": "Modules/_ssl.c",
"function": "context_dealloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-28e90ff0",
"digest": {
"length": 248,
"function_hash": "220381901430736073116727726626235635641"
},
"source": "https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b",
"target": {
"file": "Modules/_ssl.c",
"function": "context_dealloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-2935b562",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153429711935086063163460947430658631386",
"298182311063129110651363398729036403539",
"154314028276820391573889032675713599353",
"127663893816357422301843447786802351351",
"273982479869105383383500484832531424386",
"334634295412094945717228744716843989112",
"213620177722666314926856250473775789039",
"224474726826977036013941710863750715028",
"200965794566678960594364239147360223447",
"233426238470539158223951544642444436747",
"17122538462444063396004217866118950023",
"134868280002439286068086883078135053162",
"94456955139756603136277606703338650834",
"320515502552088280512473935369246263049",
"928330598485977544085734555309927917",
"181988374485011954133431812574408778853",
"252536443786263864386491430432857231076",
"17102301809910141654438822849069993215",
"135636683511366361069907664530672045358",
"103205685760401644501851548964230611853",
"47520192251176820160974047737879602159",
"18401718462189035436238846533785738882",
"172562920397322701108795649461672620993",
"165068294422223988077478544958831529137",
"52587484213727117420925375482599623172",
"195290221851674020737447393640388195136",
"38985885401218453799783517266187502274",
"185881613388837313708980656078283217095",
"50170649798958548098153477326498751940",
"66347235586602274818717650609558976735",
"325601020839065945053083254797001031075",
"110171230743522864734112935464310575322",
"164234106909424671666727040183294513733",
"2965673107828509560753931324419584771",
"146637363298031427831913838017337774047",
"62536727816982404484814386621574800345"
]
},
"source": "https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7",
"target": {
"file": "Modules/_ssl.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-2c048d5e",
"digest": {
"length": 624,
"function_hash": "163630116046655533615647944325955027425"
},
"source": "https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b",
"target": {
"file": "Modules/_ssl.c",
"function": "set_sni_callback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-3a5eb4e7",
"digest": {
"length": 248,
"function_hash": "220381901430736073116727726626235635641"
},
"source": "https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8",
"target": {
"file": "Modules/_ssl.c",
"function": "context_dealloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-3da25edf",
"digest": {
"length": 248,
"function_hash": "220381901430736073116727726626235635641"
},
"source": "https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b",
"target": {
"file": "Modules/_ssl.c",
"function": "context_dealloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-3e8f726f",
"digest": {
"length": 578,
"function_hash": "124663304027670767963381952436837139921"
},
"source": "https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7",
"target": {
"file": "Modules/_ssl.c",
"function": "_ssl__SSLContext_sni_callback_set_impl"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-45785983",
"digest": {
"length": 2261,
"function_hash": "248180368027320673485019345482916102382"
},
"source": "https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d",
"target": {
"file": "Modules/_ssl.c",
"function": "_servername_callback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-565d3f9c",
"digest": {
"length": 616,
"function_hash": "149116710923429867143554893457557409798"
},
"source": "https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b",
"target": {
"file": "Modules/_ssl.c",
"function": "set_sni_callback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-616d125e",
"digest": {
"length": 248,
"function_hash": "220381901430736073116727726626235635641"
},
"source": "https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c",
"target": {
"file": "Modules/_ssl.c",
"function": "context_dealloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-67a0c4ff",
"digest": {
"length": 1606,
"function_hash": "225751573191265639315137934041736510598"
},
"source": "https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c",
"target": {
"file": "Modules/_ssl.c",
"function": "_servername_callback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-77f4a543",
"digest": {
"length": 2261,
"function_hash": "248180368027320673485019345482916102382"
},
"source": "https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7",
"target": {
"file": "Modules/_ssl.c",
"function": "_servername_callback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-781c7300",
"digest": {
"length": 1623,
"function_hash": "329820141563626514579616945731270257807"
},
"source": "https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b",
"target": {
"file": "Modules/_ssl.c",
"function": "_servername_callback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-8e61cefa",
"digest": {
"length": 268,
"function_hash": "32533656948483893404282435038434411260"
},
"source": "https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698",
"target": {
"file": "Modules/_ssl.c",
"function": "context_dealloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-91b43e7d",
"digest": {
"length": 578,
"function_hash": "124663304027670767963381952436837139921"
},
"source": "https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d",
"target": {
"file": "Modules/_ssl.c",
"function": "_ssl__SSLContext_sni_callback_set_impl"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-94486055",
"digest": {
"length": 624,
"function_hash": "163630116046655533615647944325955027425"
},
"source": "https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8",
"target": {
"file": "Modules/_ssl.c",
"function": "set_sni_callback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-a4551a2a",
"digest": {
"length": 1623,
"function_hash": "329820141563626514579616945731270257807"
},
"source": "https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b",
"target": {
"file": "Modules/_ssl.c",
"function": "_servername_callback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-b0b5f610",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153429711935086063163460947430658631386",
"298182311063129110651363398729036403539",
"154314028276820391573889032675713599353",
"127663893816357422301843447786802351351",
"273982479869105383383500484832531424386",
"334634295412094945717228744716843989112",
"213620177722666314926856250473775789039",
"224474726826977036013941710863750715028",
"200965794566678960594364239147360223447",
"233426238470539158223951544642444436747",
"17122538462444063396004217866118950023",
"134868280002439286068086883078135053162",
"94456955139756603136277606703338650834",
"320515502552088280512473935369246263049",
"928330598485977544085734555309927917",
"181988374485011954133431812574408778853",
"252536443786263864386491430432857231076",
"17102301809910141654438822849069993215",
"135636683511366361069907664530672045358",
"103205685760401644501851548964230611853",
"47520192251176820160974047737879602159",
"18401718462189035436238846533785738882",
"172562920397322701108795649461672620993",
"165068294422223988077478544958831529137",
"52587484213727117420925375482599623172",
"195290221851674020737447393640388195136",
"38985885401218453799783517266187502274",
"185881613388837313708980656078283217095",
"50170649798958548098153477326498751940",
"66347235586602274818717650609558976735",
"325601020839065945053083254797001031075",
"110171230743522864734112935464310575322",
"164234106909424671666727040183294513733",
"2965673107828509560753931324419584771",
"146637363298031427831913838017337774047",
"62536727816982404484814386621574800345"
]
},
"source": "https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d",
"target": {
"file": "Modules/_ssl.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-c15c29ed",
"digest": {
"length": 578,
"function_hash": "124663304027670767963381952436837139921"
},
"source": "https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698",
"target": {
"file": "Modules/_ssl.c",
"function": "_ssl__SSLContext_sni_callback_set_impl"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-c34632c4",
"digest": {
"length": 1623,
"function_hash": "329820141563626514579616945731270257807"
},
"source": "https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8",
"target": {
"file": "Modules/_ssl.c",
"function": "_servername_callback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-c4cd80ac",
"digest": {
"length": 2261,
"function_hash": "248180368027320673485019345482916102382"
},
"source": "https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698",
"target": {
"file": "Modules/_ssl.c",
"function": "_servername_callback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-cbee4382",
"digest": {
"threshold": 0.9,
"line_hashes": [
"170476158416706744586282681779594726728",
"86476036914261173237508971174908544909",
"147425604329974179478204576385557413999",
"265690918346457980902501841814291472715",
"273982479869105383383500484832531424386",
"334634295412094945717228744716843989112",
"213620177722666314926856250473775789039",
"224474726826977036013941710863750715028",
"200965794566678960594364239147360223447",
"233426238470539158223951544642444436747",
"17122538462444063396004217866118950023",
"66573130367576461537947877989119307702",
"164007464104000084490636290708140145743",
"170443041069617498429182177581520475746",
"265691513509834204364860423795396781169",
"72469237269978034715513691429457912948",
"315456300782888827521076910992583209514",
"135636683511366361069907664530672045358",
"103205685760401644501851548964230611853",
"47520192251176820160974047737879602159",
"202472072711394737516678089181471628510",
"296911923594769044067645858500754066934",
"170930553121445108863477993426532935479",
"107857131919295171175990105703143114775",
"215878207680712425617714572176854254172",
"240706634002122547759684249000340367293",
"190013626958382564350712737622791187687",
"68660693758850873590704649074801451386",
"186470493458987757460490023369540254262",
"16857990377574565265995852588766344151",
"321368479543678980352146348131507804636",
"228914987871085262798083377034909088167",
"27044961477169108875234682282299655703",
"64828062720284094759206461151608573866",
"209885499725972239150228524220084795004",
"260109408203602839961906961413685969670",
"258284887827698492159567648883576774872",
"165576719922589348124044523768295957262",
"115828378121330090540176189564960727489",
"232143437476800509104357162685104346039",
"239446528826220049469262264684784563171",
"183225861499239276108178405934476583130",
"262881091645503970004104101863897337789",
"38593107192127031498014302091740162928",
"191841778618333248935672586938830816236",
"333561987953628111204678711502779305118",
"228696587423872517241141060577844354623"
]
},
"source": "https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b",
"target": {
"file": "Modules/_ssl.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-ddc4be8b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"170476158416706744586282681779594726728",
"86476036914261173237508971174908544909",
"147425604329974179478204576385557413999",
"265690918346457980902501841814291472715",
"273982479869105383383500484832531424386",
"334634295412094945717228744716843989112",
"213620177722666314926856250473775789039",
"224474726826977036013941710863750715028",
"200965794566678960594364239147360223447",
"233426238470539158223951544642444436747",
"17122538462444063396004217866118950023",
"66573130367576461537947877989119307702",
"164007464104000084490636290708140145743",
"170443041069617498429182177581520475746",
"265691513509834204364860423795396781169",
"72469237269978034715513691429457912948",
"315456300782888827521076910992583209514",
"135636683511366361069907664530672045358",
"103205685760401644501851548964230611853",
"47520192251176820160974047737879602159",
"18401718462189035436238846533785738882",
"172562920397322701108795649461672620993",
"31950349143787579572154192820452230200",
"107857131919295171175990105703143114775",
"215878207680712425617714572176854254172",
"240706634002122547759684249000340367293",
"190013626958382564350712737622791187687",
"68660693758850873590704649074801451386",
"186470493458987757460490023369540254262",
"16857990377574565265995852588766344151",
"321368479543678980352146348131507804636",
"228914987871085262798083377034909088167",
"27044961477169108875234682282299655703",
"64828062720284094759206461151608573866",
"209885499725972239150228524220084795004",
"260109408203602839961906961413685969670",
"258284887827698492159567648883576774872",
"165576719922589348124044523768295957262",
"115828378121330090540176189564960727489",
"185881613388837313708980656078283217095",
"170577468657946916650341145222521383005",
"190137971585318799538516408588102604749",
"51214415549949246111916803300351517098",
"298333175326825139692904956151545423087",
"45219436550301014820672955127681800034",
"333561987953628111204678711502779305118",
"228696587423872517241141060577844354623"
]
},
"source": "https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c",
"target": {
"file": "Modules/_ssl.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-f137023b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153429711935086063163460947430658631386",
"298182311063129110651363398729036403539",
"154314028276820391573889032675713599353",
"127663893816357422301843447786802351351",
"273982479869105383383500484832531424386",
"334634295412094945717228744716843989112",
"213620177722666314926856250473775789039",
"224474726826977036013941710863750715028",
"200965794566678960594364239147360223447",
"233426238470539158223951544642444436747",
"17122538462444063396004217866118950023",
"134868280002439286068086883078135053162",
"94456955139756603136277606703338650834",
"320515502552088280512473935369246263049",
"928330598485977544085734555309927917",
"181988374485011954133431812574408778853",
"252536443786263864386491430432857231076",
"17102301809910141654438822849069993215",
"135636683511366361069907664530672045358",
"103205685760401644501851548964230611853",
"47520192251176820160974047737879602159",
"18401718462189035436238846533785738882",
"172562920397322701108795649461672620993",
"165068294422223988077478544958831529137",
"52587484213727117420925375482599623172",
"195290221851674020737447393640388195136",
"38985885401218453799783517266187502274",
"185881613388837313708980656078283217095",
"50170649798958548098153477326498751940",
"66347235586602274818717650609558976735",
"325601020839065945053083254797001031075",
"110171230743522864734112935464310575322",
"164234106909424671666727040183294513733",
"2965673107828509560753931324419584771",
"146637363298031427831913838017337774047",
"62536727816982404484814386621574800345"
]
},
"source": "https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698",
"target": {
"file": "Modules/_ssl.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "PSF-2026-43-f6d5e596",
"digest": {
"length": 600,
"function_hash": "177689482348822481559204964585057960278"
},
"source": "https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c",
"target": {
"file": "Modules/_ssl.c",
"function": "_ssl__SSLContext_sni_callback_set_impl"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-01T08:07:50Z"
}
}
],
"modified": "2026-10-09T12:10:32.528164652Z",
"provider": "osv",
"references": [
"https://github.com/python/cpython/pull/158504",
"https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/",
"https://github.com/python/cpython/issues/156293",
"https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d",
"https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b",
"https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7",
"https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698",
"https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c",
"https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8",
"https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b"
],
"provider_metadata": {
"cwe_ids": []
}
},
"related_cves": [
{
"value": "CVE-2026-19445",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 120736,
"published_at": "2026-09-30T16:16:04.923+00:00"
}