Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-19445 hits Python Software Foundation's CPython, CVSS 9.2. A remote unauthenticated TLS client can crash the server or hit a use-after-free by making its sni_callback swap SSLContext, no valid cert or auth needed. VulnTracker recommends upgrading CPython immediately, servers that create or replace an SSLContext per connection are the ones exposed. Details:http://vulntracker.io/cves/CVE-2026-19445 #Python #CPython #CVE #InfoSec
Unpatched vulnerabilities don't stay hidden on our atlas. #CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-19445 Vendor → Unknown Severity → Critical — CVSS 9.2 Product → Unknown Date → 2026-09-30 A critical vulnerability (Use After Free) has been disclosed affecting Unknown. Patch immediately. Powered by @Brandefense #ThreatIntel #CyberSecurity #CVE #Unknown