{"id":"CVE-2026-19445","summary":"Use-after-free of a server-side SSLContext when sni_callback switches contexts","details":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected.","aliases":["PSF-2026-43"],"modified":"2026-10-03T14:07:54.156118Z","published":"2026-09-30T16:16:04.923Z","database_specific":{"cna_assigner":"PSF","cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19445.json","unresolved_ranges":[{"extracted_events":[{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"},{"introduced":"3.15.0a1"},{"fixed":"3.15.0rc3"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/09/30/17"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19445.json"},{"type":"ADVISORY","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445"},{"type":"REPORT","url":"https://github.com/python/cpython/issues/156293"},{"type":"FIX","url":"https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d"},{"type":"FIX","url":"https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b"},{"type":"FIX","url":"https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7"},{"type":"FIX","url":"https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8"},{"type":"FIX","url":"https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698"},{"type":"FIX","url":"https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c"},{"type":"FIX","url":"https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b"},{"type":"FIX","url":"https://github.com/python/cpython/pull/158504"},{"type":"PACKAGE","url":"https://github.com/python/cpython"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"0"},{"fixed":"34a53dce8174da2fceb12fe084a4def02a10053d"},{"fixed":"46133cd57d309652139ada74014aca7665ac552b"},{"fixed":"63fab143d94cafae71850831acfb52041ba44af7"},{"fixed":"b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8"},{"fixed":"cd7e51e7d4563866fbaa1e2521ae69b45daf3698"},{"fixed":"d8717ed01717a9641686e6e6f83f0ab8af235e2c"},{"fixed":"ec44b5a3258cbda947d5e07242ee562ed05ef24b"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v3.15.0rc2","v3.11.16","v3.10.21","v3.12.14","v3.13.15","v3.14.7","v3.15.0rc1","v3.15.0b4","v3.15.0b3","v3.13.14","v3.14.6","v3.15.0b2","v3.14.5","v3.15.0b1","v3.14.5rc1","v3.13.13","v3.14.4","v3.15.0a8","v3.15.0a7","v3.12.13","v3.10.20","v3.11.15","v3.15.0a6","v3.13.12","v3.14.3","v3.15.0a5","v3.15.0a4","v3.15.0a3","v3.14.2","v3.13.11","v3.13.10","v3.14.1","v3.15.0a2","v3.15.0a1","v3.13.8","v3.11.14","v3.10.19","v3.12.12","v3.14.0","v3.14.0rc3","v3.13.7","v3.14.0rc2","v3.13.6","v3.14.0rc1","v3.14.0b4","v3.14.0b3","v3.13.5","v3.13.4","v3.11.13","v3.10.18","v3.12.11","v3.14.0b2","v3.14.0b1","v3.13.3","v3.11.12","v3.12.10","v3.14.0a7","v3.10.17","v3.14.0a6","v3.14.0a5","v3.13.2","v3.12.9","v3.14.0a4","v3.14.0a3","v3.13.1","v3.12.8","v3.10.16","v3.11.11","v3.14.0a2","v3.14.0a1","v3.13.0","v3.13.0rc3","v3.12.7","v3.11.10","v3.10.15","v3.13.0rc2","v3.12.6","v3.12.5","v3.13.0rc1","v3.13.0b4","v3.13.0b3","v3.12.4","v3.13.0b2","v3.13.0b1","v3.13.0a6","v3.12.3","v3.11.9","v3.10.14","v3.13.0a5","v3.13.0a4","v3.12.2","v3.11.8","v3.13.0a3","v3.12.1","v3.11.7","v3.13.0a2","v3.13.0a1","v3.11.6","v3.12.0","v3.12.0rc3","v3.12.0rc2","v3.11.5","v3.10.13","v3.12.0rc1","v3.12.0b4","v3.12.0b3","v3.11.4","v3.10.12","v3.12.0b2","v3.12.0b1","v3.10.11","v3.11.3","v3.12.0a7","v3.12.0a6","v3.10.10","v3.11.2","v3.12.0a5","v3.12.0a4","v3.12.0a3","v3.10.9","v3.11.1","v3.12.0a2","v3.12.0a1","v3.11.0rc2","v3.10.8","v3.10.7","v3.11.0rc1","v3.10.6","v3.11.0b5","v3.11.0b4","v3.10.5","v3.11.0b3","v3.11.0b2","v3.11.0b1","v3.11.0a7","v3.10.4","v3.10.3","v3.11.0a6","v3.11.0a5","v3.11.0a4","v3.10.2","v3.11.0a3","v3.10.1","v3.10.0rc2","v3.10.0rc1","v3.10.0b4","v3.10.0b3","v3.10.0b2","v3.10.0b1","v3.10.0a7","v3.10.0a1","v3.9.0a2","v3.7.0a2","v3.6.0b1","v3.6.0a3","v3.5.0b1","v3.5.0a4","v3.5.0a3","v3.5.0a2","v3.5.0a1","v3.4.0b3","v3.4.0b2","v3.4.0b1","v3.4.0a4","v3.4.0a3","v3.4.0a2","v3.4.0a1","v3.3.0rc3","v3.3.0rc2","v3.3.0rc1","v3.3.0b2","v3.3.0b1","v3.3.0a4","v3.3.0a3","v3.3.0a2","v3.2rc3","v3.2rc2","v3.2rc1","v3.2b2","v3.2b1","v3.2a4","v3.2a3","v3.2a2","v3.2a1","v3.1","v3.1rc2","v3.1rc1","v3.1b1","v3.1a2","v3.1a1","v3.0rc3","v3.0rc2","v3.0rc1","v3.0b3","v3.0b2","v3.0b1","v3.0a5","v3.0a4","v3.0a3","v3.0a2","v3.0a1","v2.4","v2.4c1","v2.4b2","v2.4b1","v2.4a3","v2.4a2","v2.4a1","v2.3c2","v2.3c1","v2.2a3","v2.1","v2.1c2","v2.1c1","v2.1b2","v2.1b1","v2.1a2","v2.1a1","v2.0","v2.0c1","v2.0b2","v2.0b1","v1.6a2","v1.6a1","v1.5.2","v1.5.2c1","v1.5.2b2","v1.5.2b1","v1.5.2a2","v1.5.2a1","v1.5.1","v1.5","v1.5b2","v1.5b1","v1.5a4","v1.5a3","v1.5a2","v1.5a1","v1.4","v1.4b3","v1.4b2","v1.4b1","v1.3","v1.3b1","v1.2","v1.2b4","v1.2b3","v1.2b2","v1.2b1","v1.1.1","v1.1","v1.0.2","v1.0.1","v0.9.9","v0.9.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19445.json","vanir_signatures_modified":"2026-10-03T14:07:54Z","vanir_signatures":[{"id":"CVE-2026-19445-0872e0f6","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["170476158416706744586282681779594726728","86476036914261173237508971174908544909","147425604329974179478204576385557413999","265690918346457980902501841814291472715","273982479869105383383500484832531424386","334634295412094945717228744716843989112","213620177722666314926856250473775789039","224474726826977036013941710863750715028","200965794566678960594364239147360223447","233426238470539158223951544642444436747","17122538462444063396004217866118950023","66573130367576461537947877989119307702","164007464104000084490636290708140145743","170443041069617498429182177581520475746","265691513509834204364860423795396781169","72469237269978034715513691429457912948","315456300782888827521076910992583209514","135636683511366361069907664530672045358","103205685760401644501851548964230611853","47520192251176820160974047737879602159","202472072711394737516678089181471628510","296911923594769044067645858500754066934","170930553121445108863477993426532935479","107857131919295171175990105703143114775","215878207680712425617714572176854254172","240706634002122547759684249000340367293","190013626958382564350712737622791187687","68660693758850873590704649074801451386","186470493458987757460490023369540254262","16857990377574565265995852588766344151","321368479543678980352146348131507804636","228914987871085262798083377034909088167","27044961477169108875234682282299655703","64828062720284094759206461151608573866","209885499725972239150228524220084795004","260109408203602839961906961413685969670","258284887827698492159567648883576774872","165576719922589348124044523768295957262","115828378121330090540176189564960727489","232143437476800509104357162685104346039","239446528826220049469262264684784563171","183225861499239276108178405934476583130","262881091645503970004104101863897337789","122838324552460613522635150517682423329","278491848832606031486833309611652744368","333561987953628111204678711502779305118","228696587423872517241141060577844354623"],"threshold":0.9}},{"target":{"file":"Modules/_ssl.c","function":"context_dealloc"},"deprecated":false,"digest":{"length":268,"function_hash":"32533656948483893404282435038434411260"},"id":"CVE-2026-19445-08d313e1","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7"},{"deprecated":false,"digest":{"line_hashes":["170476158416706744586282681779594726728","86476036914261173237508971174908544909","147425604329974179478204576385557413999","265690918346457980902501841814291472715","273982479869105383383500484832531424386","334634295412094945717228744716843989112","213620177722666314926856250473775789039","224474726826977036013941710863750715028","200965794566678960594364239147360223447","233426238470539158223951544642444436747","17122538462444063396004217866118950023","66573130367576461537947877989119307702","164007464104000084490636290708140145743","170443041069617498429182177581520475746","265691513509834204364860423795396781169","72469237269978034715513691429457912948","315456300782888827521076910992583209514","135636683511366361069907664530672045358","103205685760401644501851548964230611853","47520192251176820160974047737879602159","202472072711394737516678089181471628510","296911923594769044067645858500754066934","170930553121445108863477993426532935479","107857131919295171175990105703143114775","215878207680712425617714572176854254172","240706634002122547759684249000340367293","190013626958382564350712737622791187687","68660693758850873590704649074801451386","186470493458987757460490023369540254262","16857990377574565265995852588766344151","321368479543678980352146348131507804636","228914987871085262798083377034909088167","27044961477169108875234682282299655703","64828062720284094759206461151608573866","209885499725972239150228524220084795004","260109408203602839961906961413685969670","258284887827698492159567648883576774872","165576719922589348124044523768295957262","115828378121330090540176189564960727489","232143437476800509104357162685104346039","239446528826220049469262264684784563171","183225861499239276108178405934476583130","262881091645503970004104101863897337789","38593107192127031498014302091740162928","191841778618333248935672586938830816236","333561987953628111204678711502779305118","228696587423872517241141060577844354623"],"threshold":0.9},"id":"CVE-2026-19445-1224929b","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","target":{"file":"Modules/_ssl.c"}},{"id":"CVE-2026-19445-14ccff3b","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","target":{"file":"Modules/_ssl.c","function":"context_dealloc"},"deprecated":false,"digest":{"function_hash":"32533656948483893404282435038434411260","length":268}},{"source":"https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","target":{"file":"Modules/_ssl.c","function":"context_dealloc"},"deprecated":false,"digest":{"function_hash":"220381901430736073116727726626235635641","length":248},"id":"CVE-2026-19445-28e90ff0","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["153429711935086063163460947430658631386","298182311063129110651363398729036403539","154314028276820391573889032675713599353","127663893816357422301843447786802351351","273982479869105383383500484832531424386","334634295412094945717228744716843989112","213620177722666314926856250473775789039","224474726826977036013941710863750715028","200965794566678960594364239147360223447","233426238470539158223951544642444436747","17122538462444063396004217866118950023","134868280002439286068086883078135053162","94456955139756603136277606703338650834","320515502552088280512473935369246263049","928330598485977544085734555309927917","181988374485011954133431812574408778853","252536443786263864386491430432857231076","17102301809910141654438822849069993215","135636683511366361069907664530672045358","103205685760401644501851548964230611853","47520192251176820160974047737879602159","18401718462189035436238846533785738882","172562920397322701108795649461672620993","165068294422223988077478544958831529137","52587484213727117420925375482599623172","195290221851674020737447393640388195136","38985885401218453799783517266187502274","185881613388837313708980656078283217095","50170649798958548098153477326498751940","66347235586602274818717650609558976735","325601020839065945053083254797001031075","110171230743522864734112935464310575322","164234106909424671666727040183294513733","2965673107828509560753931324419584771","146637363298031427831913838017337774047","62536727816982404484814386621574800345"],"threshold":0.9},"id":"CVE-2026-19445-2935b562","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","target":{"file":"Modules/_ssl.c","function":"set_sni_callback"},"deprecated":false,"digest":{"function_hash":"163630116046655533615647944325955027425","length":624},"id":"CVE-2026-19445-2c048d5e"},{"target":{"function":"context_dealloc","file":"Modules/_ssl.c"},"deprecated":false,"digest":{"function_hash":"220381901430736073116727726626235635641","length":248},"id":"CVE-2026-19445-3a5eb4e7","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8"},{"deprecated":false,"digest":{"function_hash":"220381901430736073116727726626235635641","length":248},"id":"CVE-2026-19445-3da25edf","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","target":{"file":"Modules/_ssl.c","function":"context_dealloc"}},{"deprecated":false,"digest":{"function_hash":"124663304027670767963381952436837139921","length":578},"id":"CVE-2026-19445-3e8f726f","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_sni_callback_set_impl"}},{"deprecated":false,"digest":{"function_hash":"248180368027320673485019345482916102382","length":2261},"id":"CVE-2026-19445-45785983","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","target":{"file":"Modules/_ssl.c","function":"_servername_callback"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","target":{"file":"Modules/_ssl.c","function":"set_sni_callback"},"deprecated":false,"digest":{"length":616,"function_hash":"149116710923429867143554893457557409798"},"id":"CVE-2026-19445-565d3f9c"},{"target":{"function":"context_dealloc","file":"Modules/_ssl.c"},"deprecated":false,"digest":{"function_hash":"220381901430736073116727726626235635641","length":248},"id":"CVE-2026-19445-616d125e","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c"},{"id":"CVE-2026-19445-67a0c4ff","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","target":{"file":"Modules/_ssl.c","function":"_servername_callback"},"deprecated":false,"digest":{"function_hash":"225751573191265639315137934041736510598","length":1606}},{"deprecated":false,"digest":{"length":2261,"function_hash":"248180368027320673485019345482916102382"},"id":"CVE-2026-19445-77f4a543","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","target":{"file":"Modules/_ssl.c","function":"_servername_callback"}},{"target":{"file":"Modules/_ssl.c","function":"_servername_callback"},"deprecated":false,"digest":{"function_hash":"329820141563626514579616945731270257807","length":1623},"id":"CVE-2026-19445-781c7300","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b"},{"target":{"file":"Modules/_ssl.c","function":"context_dealloc"},"deprecated":false,"digest":{"length":268,"function_hash":"32533656948483893404282435038434411260"},"id":"CVE-2026-19445-8e61cefa","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698"},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","target":{"function":"_ssl__SSLContext_sni_callback_set_impl","file":"Modules/_ssl.c"},"deprecated":false,"digest":{"function_hash":"124663304027670767963381952436837139921","length":578},"id":"CVE-2026-19445-91b43e7d","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"163630116046655533615647944325955027425","length":624},"id":"CVE-2026-19445-94486055","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","target":{"file":"Modules/_ssl.c","function":"set_sni_callback"}},{"deprecated":false,"digest":{"function_hash":"329820141563626514579616945731270257807","length":1623},"id":"CVE-2026-19445-a4551a2a","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","target":{"function":"_servername_callback","file":"Modules/_ssl.c"}},{"deprecated":false,"digest":{"line_hashes":["153429711935086063163460947430658631386","298182311063129110651363398729036403539","154314028276820391573889032675713599353","127663893816357422301843447786802351351","273982479869105383383500484832531424386","334634295412094945717228744716843989112","213620177722666314926856250473775789039","224474726826977036013941710863750715028","200965794566678960594364239147360223447","233426238470539158223951544642444436747","17122538462444063396004217866118950023","134868280002439286068086883078135053162","94456955139756603136277606703338650834","320515502552088280512473935369246263049","928330598485977544085734555309927917","181988374485011954133431812574408778853","252536443786263864386491430432857231076","17102301809910141654438822849069993215","135636683511366361069907664530672045358","103205685760401644501851548964230611853","47520192251176820160974047737879602159","18401718462189035436238846533785738882","172562920397322701108795649461672620993","165068294422223988077478544958831529137","52587484213727117420925375482599623172","195290221851674020737447393640388195136","38985885401218453799783517266187502274","185881613388837313708980656078283217095","50170649798958548098153477326498751940","66347235586602274818717650609558976735","325601020839065945053083254797001031075","110171230743522864734112935464310575322","164234106909424671666727040183294513733","2965673107828509560753931324419584771","146637363298031427831913838017337774047","62536727816982404484814386621574800345"],"threshold":0.9},"id":"CVE-2026-19445-b0b5f610","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","target":{"file":"Modules/_ssl.c"}},{"deprecated":false,"digest":{"function_hash":"124663304027670767963381952436837139921","length":578},"id":"CVE-2026-19445-c15c29ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_sni_callback_set_impl"}},{"digest":{"function_hash":"329820141563626514579616945731270257807","length":1623},"id":"CVE-2026-19445-c34632c4","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","target":{"file":"Modules/_ssl.c","function":"_servername_callback"},"deprecated":false},{"target":{"file":"Modules/_ssl.c","function":"_servername_callback"},"deprecated":false,"digest":{"function_hash":"248180368027320673485019345482916102382","length":2261},"id":"CVE-2026-19445-c4cd80ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698"},{"id":"CVE-2026-19445-cbee4382","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["170476158416706744586282681779594726728","86476036914261173237508971174908544909","147425604329974179478204576385557413999","265690918346457980902501841814291472715","273982479869105383383500484832531424386","334634295412094945717228744716843989112","213620177722666314926856250473775789039","224474726826977036013941710863750715028","200965794566678960594364239147360223447","233426238470539158223951544642444436747","17122538462444063396004217866118950023","66573130367576461537947877989119307702","164007464104000084490636290708140145743","170443041069617498429182177581520475746","265691513509834204364860423795396781169","72469237269978034715513691429457912948","315456300782888827521076910992583209514","135636683511366361069907664530672045358","103205685760401644501851548964230611853","47520192251176820160974047737879602159","202472072711394737516678089181471628510","296911923594769044067645858500754066934","170930553121445108863477993426532935479","107857131919295171175990105703143114775","215878207680712425617714572176854254172","240706634002122547759684249000340367293","190013626958382564350712737622791187687","68660693758850873590704649074801451386","186470493458987757460490023369540254262","16857990377574565265995852588766344151","321368479543678980352146348131507804636","228914987871085262798083377034909088167","27044961477169108875234682282299655703","64828062720284094759206461151608573866","209885499725972239150228524220084795004","260109408203602839961906961413685969670","258284887827698492159567648883576774872","165576719922589348124044523768295957262","115828378121330090540176189564960727489","232143437476800509104357162685104346039","239446528826220049469262264684784563171","183225861499239276108178405934476583130","262881091645503970004104101863897337789","38593107192127031498014302091740162928","191841778618333248935672586938830816236","333561987953628111204678711502779305118","228696587423872517241141060577844354623"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["170476158416706744586282681779594726728","86476036914261173237508971174908544909","147425604329974179478204576385557413999","265690918346457980902501841814291472715","273982479869105383383500484832531424386","334634295412094945717228744716843989112","213620177722666314926856250473775789039","224474726826977036013941710863750715028","200965794566678960594364239147360223447","233426238470539158223951544642444436747","17122538462444063396004217866118950023","66573130367576461537947877989119307702","164007464104000084490636290708140145743","170443041069617498429182177581520475746","265691513509834204364860423795396781169","72469237269978034715513691429457912948","315456300782888827521076910992583209514","135636683511366361069907664530672045358","103205685760401644501851548964230611853","47520192251176820160974047737879602159","18401718462189035436238846533785738882","172562920397322701108795649461672620993","31950349143787579572154192820452230200","107857131919295171175990105703143114775","215878207680712425617714572176854254172","240706634002122547759684249000340367293","190013626958382564350712737622791187687","68660693758850873590704649074801451386","186470493458987757460490023369540254262","16857990377574565265995852588766344151","321368479543678980352146348131507804636","228914987871085262798083377034909088167","27044961477169108875234682282299655703","64828062720284094759206461151608573866","209885499725972239150228524220084795004","260109408203602839961906961413685969670","258284887827698492159567648883576774872","165576719922589348124044523768295957262","115828378121330090540176189564960727489","185881613388837313708980656078283217095","170577468657946916650341145222521383005","190137971585318799538516408588102604749","51214415549949246111916803300351517098","298333175326825139692904956151545423087","45219436550301014820672955127681800034","333561987953628111204678711502779305118","228696587423872517241141060577844354623"],"threshold":0.9},"id":"CVE-2026-19445-ddc4be8b","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","target":{"file":"Modules/_ssl.c"}},{"target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["153429711935086063163460947430658631386","298182311063129110651363398729036403539","154314028276820391573889032675713599353","127663893816357422301843447786802351351","273982479869105383383500484832531424386","334634295412094945717228744716843989112","213620177722666314926856250473775789039","224474726826977036013941710863750715028","200965794566678960594364239147360223447","233426238470539158223951544642444436747","17122538462444063396004217866118950023","134868280002439286068086883078135053162","94456955139756603136277606703338650834","320515502552088280512473935369246263049","928330598485977544085734555309927917","181988374485011954133431812574408778853","252536443786263864386491430432857231076","17102301809910141654438822849069993215","135636683511366361069907664530672045358","103205685760401644501851548964230611853","47520192251176820160974047737879602159","18401718462189035436238846533785738882","172562920397322701108795649461672620993","165068294422223988077478544958831529137","52587484213727117420925375482599623172","195290221851674020737447393640388195136","38985885401218453799783517266187502274","185881613388837313708980656078283217095","50170649798958548098153477326498751940","66347235586602274818717650609558976735","325601020839065945053083254797001031075","110171230743522864734112935464310575322","164234106909424671666727040183294513733","2965673107828509560753931324419584771","146637363298031427831913838017337774047","62536727816982404484814386621574800345"],"threshold":0.9},"id":"CVE-2026-19445-f137023b","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698"},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_sni_callback_set_impl"},"deprecated":false,"digest":{"function_hash":"177689482348822481559204964585057960278","length":600},"id":"CVE-2026-19445-f6d5e596","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"}]}