CLSA-2026-1791493434 Fix CVE(s): CVE-2026-19445, CVE-2026-4786

SECURITY UPDATE: use-after-free in the ssl servername SNI callback CVE-2026-19445 - debian/patches/CVE-2026-19445.patch: look the SSLContext up from the SSL object instead of the borrowed pointer registered with OpenSSL, hold references to it and to the callback while it runs, and unregister the...

CLSA-2026-1791372827 Fix CVE(s): CVE-2026-19445, CVE-2026-4786

SECURITY UPDATE: use-after-free in the ssl servername SNI callback CVE-2026-19445 - debian/patches/CVE-2026-19445.patch: look the SSLContext up from the SSL object instead of the borrowed pointer registered with OpenSSL, hold references to it and to the callback while it runs, and unregister the...

CLSA-2026-1791559300 python3.9: Fix of CVE-2026-19445

CVE-2026-19445: ssl: look up the SSLContext for the servername SNI callback from the SSL connection instead of a borrowed pointer, and unregister the callback when the context is deallocated...

CLSA-2026-1791535989 Fix CVE(s): CVE-2026-19445, CVE-2026-19553

SECURITY UPDATE: hostname verification silently skipped by SSLContext.wrapbio when no serverhostname is given - debian/patches/CVE-2026-19553.patch: in Lib/ssl.py, validate the wrapbio arguments like wrapsocket does: reject serverhostname and session in server mode, and emit a DeprecationWarning...

PT-2026-109168

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni callback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

PT-2026-109164

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni callback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

PT-2026-109166

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni callback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

CLSA-2026-1791424578 python: Fix of CVE-2026-19445

CVE-2026-19445: fix use-after-free in the ssl servername SNI callback - the callback reached its SSLContext through a borrowed pointer registered with OpenSSL, so once the callback switched SSLSocket.context to another context and nothing else referenced the original one, the freed object was...

CLSA-2026-1791425564 python: Fix of CVE-2026-19445

CVE-2026-19445: fix use-after-free in the ssl servername SNI callback - the callback reached its SSLContext through a borrowed pointer registered with OpenSSL, so once the callback switched SSLSocket.context to another context and nothing else referenced the original one, the freed object was...

CLSA-2026-1791425064 python: Fix of CVE-2026-19445

CVE-2026-19445: fix use-after-free in the ssl servername SNI callback - the callback reached its SSLContext through a borrowed pointer registered with OpenSSL, so once the callback switched SSLSocket.context to another context and nothing else referenced the original one, the freed object was...

PT-2026-105768

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni callback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

PT-2026-103460

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A remote, unauthenticated TLS client can cause a server to crash or trigger a use-after-free condition where the system attempts to use a memory pointer after i...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities due to pyOpenSSL

Summary pyOpenSSL is used by IBM Integrated Analytics System as a Python wrapper around the OpenSSL library for SSL/TLS functionality. Multiple vulnerabilities affect pyOpenSSL versions prior to 26.0.0. CVE-2026-27448 involves a "fail open" behavior where an unhandled exception in a user-provided...