RHSA-2026:77017HighCVSS 8.1

Red Hat Security Advisory: python3.12 security update

Published
October 8, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (2)

CVE-2026-19445 →CVE-2026-19553 →

📋 Description

CVE-2026-19445 — python: Use-after-free of a server-side SSLContext when sni_callback switches contexts CVE-2026-19553 — python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

🎯 Affected products58

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-0:3.12.15-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-0:3.12.15-1.el9_8.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-0:3.12.15-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-0:3.12.15-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-0:3.12.15-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-0:3.12.15-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-debug-0:3.12.15-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debug-0:3.12.15-1.el9_8.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debug-0:3.12.15-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debug-0:3.12.15-1.el9_8.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debug-0:3.12.15-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debuginfo-0:3.12.15-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-debuginfo-0:3.12.15-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debuginfo-0:3.12.15-1.el9_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-debuginfo-0:3.12.15-1.el9_8.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debuginfo-0:3.12.15-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-debuginfo-0:3.12.15-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debuginfo-0:3.12.15-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-debuginfo-0:3.12.15-1.el9_8.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debuginfo-0:3.12.15-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-debuginfo-0:3.12.15-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debugsource-0:3.12.15-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-debugsource-0:3.12.15-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debugsource-0:3.12.15-1.el9_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-debugsource-0:3.12.15-1.el9_8.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debugsource-0:3.12.15-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.12-debugsource-0:3.12.15-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • python3.12-debugsource-0:3.12.15-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +28 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Restrict Python TLS servers that use SSLContext.sni_callback to trusted clients. Keep a strong reference to every SSLContext that registers an SNI callback for the lifetime of the server so the original context cannot be garbage-collected while connections remain open. Prefer wrapping the listening socket with a long-lived SSLContext; that common pattern is not affected. Host heap allocator hardening increases the difficulty of turning the use-after-free into reliable code execution but does not prevent process crashes. Workaround: Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped.

🔗 References (5)