UnratedFix available
python: Fix of CVE-2026-19445
Type: advisorySources: OSV
- CVE-2026-19445: fix use-after-free in the ssl servername (SNI) callback - the callback reached its SSLContext through a borrowed pointer registered with OpenSSL, so once the callback switched SSLSocket.context to another context and nothing else referenced the original one, the freed object was used after the callback returned or on a later ClientHello. Look the context up from the connection instead and unregister the callback when the context is deallocated. Backported from upstream CPython (gh-156293, GH-158504).
- Products
- python, python-debug, python-devel, python-libs, python-test, python-tools, tkinter
- Affected versions
- Not specified
- Fixed versions
- 2.7.5-94.0.9.el7_9.tuxcare.els2
- CVEs
- CVE-2026-19445
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:09 UTC · Revision 1
Source evidence
- CVE-2026-19445: fix use-after-free in the ssl servername (SNI) callback - the callback reached its SSLContext through a borrowed pointer registered with OpenSSL, so once the callback switched SSLSocket.context to another context and nothing else referenced the original one, the freed object was used after the callback returned or on a later ClientHello. Look the context up from the connection instead and unregister the callback when the context is deallocated. Backported from upstream CPython (gh-156293, GH-158504).
osv:CLSA-2026-1791424578
python
Fixed versions: 2.7.5-94.0.9.el7_9.tuxcare.els2
python-debug
Fixed versions: 2.7.5-94.0.9.el7_9.tuxcare.els2
python-devel
Fixed versions: 2.7.5-94.0.9.el7_9.tuxcare.els2
python-libs
Fixed versions: 2.7.5-94.0.9.el7_9.tuxcare.els2
python-test
Fixed versions: 2.7.5-94.0.9.el7_9.tuxcare.els2
python-tools
Fixed versions: 2.7.5-94.0.9.el7_9.tuxcare.els2
tkinter
Fixed versions: 2.7.5-94.0.9.el7_9.tuxcare.els2
Complete source record
{
"id": "691777f6d79b0dd9c1cbcff3bfb7b3ad62fc887fe97a1669c466592493765fbb",
"url": "https://osv.dev/vulnerability/CLSA-2026-1791424578",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "python: Fix of CVE-2026-19445",
"summary": "- CVE-2026-19445: fix use-after-free in the ssl servername (SNI) callback - the callback reached its SSLContext through a borrowed pointer registered with OpenSSL, so once the callback switched SSLSocket.context to another context and nothing else referenced the original one, the freed object was used after the callback returned or on a later ClientHello. Look the context up from the connection instead and unregister the callback when the context is deallocated. Backported from upstream CPython (gh-156293, GH-158504).",
"evidence": "osv:CLSA-2026-1791424578",
"products": [
{
"name": {
"value": "python",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.9.el7_9.tuxcare.els2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-debug",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.9.el7_9.tuxcare.els2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-devel",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.9.el7_9.tuxcare.els2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-libs",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.9.el7_9.tuxcare.els2",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-test",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.9.el7_9.tuxcare.els2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-tools",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.9.el7_9.tuxcare.els2",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tkinter",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.9.el7_9.tuxcare.els2",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1791424578",
"aliases": [
"CLSA-2026-1791424578"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.9.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python",
"purl": "pkg:rpm/tuxcare/python?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1791424578.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.9.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python-debug",
"purl": "pkg:rpm/tuxcare/python-debug?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1791424578.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.9.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python-devel",
"purl": "pkg:rpm/tuxcare/python-devel?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1791424578.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.9.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python-libs",
"purl": "pkg:rpm/tuxcare/python-libs?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1791424578.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.9.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python-test",
"purl": "pkg:rpm/tuxcare/python-test?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1791424578.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.9.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python-tools",
"purl": "pkg:rpm/tuxcare/python-tools?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1791424578.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.9.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "tkinter",
"purl": "pkg:rpm/tuxcare/tkinter?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1791424578.json"
}
}
],
"modified": "2026-10-26T09:31:48.755088487Z",
"provider": "osv",
"upstream": [
"CVE-2026-19445"
],
"references": [
"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1791424578.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19445"
]
},
"related_cves": [
{
"value": "CVE-2026-19445",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 448519,
"published_at": "2026-10-08T21:57:52+00:00"
}