REDHAT-BUG-2544138: High severity Python Software Foundation Python vulnerability

Published Sep 30, 2026

Updated

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected.

Mitigation: keep a reference to every SSLContext that sets snicallback for the lifetime of the server. TLS clients are not affected.

Affected Software

1 affected component

Python Software Foundation Python

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Keep a reference to every ssl.SSLContext that sets sni_callback for the lifetime of the server, including contexts used when creating an SSLContext per connection or replacing SSLSocket.context.

Event History

Sep 30, 2026

Data Sourced

via Red Hat·04:47 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Affected deployments are TLS servers whose sni_callback changes SSLSocket.context to select certificates and where the original ssl.SSLContext is not kept alive. Servers that wrap their listening socket with the context are not affected, and TLS clients are not affected.

What must an attacker do to trigger the problem?

An attacker only needs to act as a remote, unauthenticated TLS client and connect to the affected server. Exploitation depends on the server using an sni_callback that assigns a different context and allowing the original context to be released.

What can be done if updating is not immediately possible?

Keep a reference to every ssl.SSLContext that sets sni_callback for the full lifetime of the server. This prevents the original context from being freed while connections may still use it.

How can I determine whether my server is affected?

Review TLS server code for sni_callback handlers that assign a new value to SSLSocket.context. The server is at risk if the original SSLContext can be garbage-collected, such as when contexts are created per connection or replaced while connections remain open.

REDHAT-BUG-2544138: High severity Python Software Foundation Python vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the problem?

What can be done if updating is not immediately possible?

How can I determine whether my server is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the problem?

What can be done if updating is not immediately possible?

How can I determine whether my server is affected?