UnratedFix available
python2: Fix of CVE-2026-19445
Type: advisorySources: OSV
- CVE-2026-19445: look up the SNI servername callback's SSLContext from the connection instead of the borrowed pointer registered with OpenSSL, and hold strong references to that context and to the callback while they are in use, so a callback that switches the socket to another context and drops the last reference to the context carrying it can no longer be reached through freed memory; the servername callback is also unregistered when a context is deallocated, since its SSL_CTX can outlive the Python object
- Products
- python2, python2-debug, python2-devel, python2-libs, python2-test, python2-tkinter, python2-tools
- Affected versions
- Not specified
- Fixed versions
- 2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29
- CVEs
- CVE-2026-19445
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:04 UTC · Revision 1
Source evidence
- CVE-2026-19445: look up the SNI servername callback's SSLContext from the connection instead of the borrowed pointer registered with OpenSSL, and hold strong references to that context and to the callback while they are in use, so a callback that switches the socket to another context and drops the last reference to the context carrying it can no longer be reached through freed memory; the servername callback is also unregistered when a context is deallocated, since its SSL_CTX can outlive the Python object
osv:CLSA-2026-1791965784
python2
Fixed versions: 2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29
python2-debug
Fixed versions: 2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29
python2-devel
Fixed versions: 2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29
python2-libs
Fixed versions: 2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29
python2-test
Fixed versions: 2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29
python2-tkinter
Fixed versions: 2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29
python2-tools
Fixed versions: 2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29
Complete source record
{
"id": "34d26dffb83d9e173b3b4dcbbbe3a041739a555f575f440a9c0d374a05af1c09",
"url": "https://osv.dev/vulnerability/CLSA-2026-1791965784",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "python2: Fix of CVE-2026-19445",
"summary": "- CVE-2026-19445: look up the SNI servername callback's SSLContext from the connection instead of the borrowed pointer registered with OpenSSL, and hold strong references to that context and to the callback while they are in use, so a callback that switches the socket to another context and drops the last reference to the context carrying it can no longer be reached through freed memory; the servername callback is also unregistered when a context is deallocated, since its SSL_CTX can outlive the Python object",
"evidence": "osv:CLSA-2026-1791965784",
"products": [
{
"name": {
"value": "python2",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python2-debug",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python2-devel",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python2-libs",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python2-test",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python2-tkinter",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python2-tools",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1791965784",
"aliases": [
"CLSA-2026-1791965784"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29"
}
]
}
],
"package": {
"name": "python2",
"purl": "pkg:rpm/tuxcare/python2?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1791965784.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29"
}
]
}
],
"package": {
"name": "python2-debug",
"purl": "pkg:rpm/tuxcare/python2-debug?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1791965784.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29"
}
]
}
],
"package": {
"name": "python2-devel",
"purl": "pkg:rpm/tuxcare/python2-devel?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1791965784.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29"
}
]
}
],
"package": {
"name": "python2-libs",
"purl": "pkg:rpm/tuxcare/python2-libs?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1791965784.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29"
}
]
}
],
"package": {
"name": "python2-test",
"purl": "pkg:rpm/tuxcare/python2-test?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1791965784.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29"
}
]
}
],
"package": {
"name": "python2-tkinter",
"purl": "pkg:rpm/tuxcare/python2-tkinter?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1791965784.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.18-4.module_el8.4.0+2679+b40f26fc.tuxcare.els29"
}
]
}
],
"package": {
"name": "python2-tools",
"purl": "pkg:rpm/tuxcare/python2-tools?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1791965784.json"
}
}
],
"modified": "2026-10-26T09:31:44.153796833Z",
"provider": "osv",
"upstream": [
"CVE-2026-19445"
],
"references": [
"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1791965784.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19445"
]
},
"related_cves": [
{
"value": "CVE-2026-19445",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 448300,
"published_at": "2026-10-14T08:16:35+00:00"
}