RHSA-2026:94443HighCVSS 8.1

Red Hat Security Advisory: python3 security update

Published
November 3, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (2)

CVE-2026-19445 →CVE-2026-19553 →

📋 Description

CVE-2026-19445 — python: Use-after-free of a server-side SSLContext when sni_callback switches contexts CVE-2026-19553 — python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

🎯 Affected products50

  • Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • platform-python-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • platform-python-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • platform-python-0:3.6.8-47.el8_6.16.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • platform-python-0:3.6.8-47.el8_6.16.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • platform-python-debug-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • platform-python-debug-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • platform-python-debug-0:3.6.8-47.el8_6.16.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • platform-python-debug-0:3.6.8-47.el8_6.16.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • platform-python-devel-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • platform-python-devel-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • platform-python-devel-0:3.6.8-47.el8_6.16.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • platform-python-devel-0:3.6.8-47.el8_6.16.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • python3-0:3.6.8-47.el8_6.16.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • python3-0:3.6.8-47.el8_6.16.src as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • python3-debuginfo-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • python3-debuginfo-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • python3-debuginfo-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • python3-debuginfo-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • python3-debuginfo-0:3.6.8-47.el8_6.16.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • python3-debuginfo-0:3.6.8-47.el8_6.16.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • python3-debuginfo-0:3.6.8-47.el8_6.16.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • python3-debuginfo-0:3.6.8-47.el8_6.16.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • python3-debugsource-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • python3-debugsource-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • python3-debugsource-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • python3-debugsource-0:3.6.8-47.el8_6.16.i686 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • +20 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Restrict Python TLS servers that use SSLContext.sni_callback to trusted clients. Keep a strong reference to every SSLContext that registers an SNI callback for the lifetime of the server so the original context cannot be garbage-collected while connections remain open. Prefer wrapping the listening socket with a long-lived SSLContext; that common pattern is not affected. Host heap allocator hardening increases the difficulty of turning the use-after-free into reliable code execution but does not prevent process crashes. Workaround: Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped.

🔗 References (5)