RHSA-2026:77018HighCVSS 8.1

Red Hat Security Advisory: python3.14 security update

Published
October 8, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (2)

CVE-2026-19553 →CVE-2026-19445 →

📋 Description

CVE-2026-19445 — python: Use-after-free of a server-side SSLContext when sni_callback switches contexts CVE-2026-19553 — python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

🎯 Affected products75

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-0:3.14.8-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-0:3.14.8-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-0:3.14.8-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-0:3.14.8-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-0:3.14.8-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-debug-0:3.14.8-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-debug-0:3.14.8-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-debug-0:3.14.8-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-debug-0:3.14.8-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-debuginfo-0:3.14.8-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-debuginfo-0:3.14.8-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-debuginfo-0:3.14.8-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-debuginfo-0:3.14.8-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-debuginfo-0:3.14.8-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-debuginfo-0:3.14.8-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-debuginfo-0:3.14.8-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-debuginfo-0:3.14.8-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-debugsource-0:3.14.8-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-debugsource-0:3.14.8-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-debugsource-0:3.14.8-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-debugsource-0:3.14.8-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-debugsource-0:3.14.8-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-debugsource-0:3.14.8-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-debugsource-0:3.14.8-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-debugsource-0:3.14.8-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3.14-devel-0:3.14.8-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-devel-0:3.14.8-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3.14-devel-0:3.14.8-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +45 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Restrict Python TLS servers that use SSLContext.sni_callback to trusted clients. Keep a strong reference to every SSLContext that registers an SNI callback for the lifetime of the server so the original context cannot be garbage-collected while connections remain open. Prefer wrapping the listening socket with a long-lived SSLContext; that common pattern is not affected. Host heap allocator hardening increases the difficulty of turning the use-after-free into reliable code execution but does not prevent process crashes. Workaround: Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped.

🔗 References (5)