CVE-2026-19445
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context
CVSS
—
Sin CVSS
EPSS
0.4%
p36
KEV
—
Exploit Today
11
0-100
Publicado: 30 sept 2026 · Última mod.: 3 oct 2026 · CWE-416
0.4%EPSS · 30 días0.5%
2026-10-012026-10-21
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
- github.comhttps://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d
- github.comhttps://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b
- github.comhttps://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7
- github.comhttps://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8
- github.comhttps://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698
- github.comhttps://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c
- github.comhttps://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b
- github.comhttps://github.com/python/cpython/issues/156293
- github.comhttps://github.com/python/cpython/pull/158504
- mail.python.orghttps://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2026/09/30/17
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1118048.2 ALT—
———Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.21hCVE-2026-1096199.8 CRÍ—
———PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).7hCVE-2026-1096189.8 CRÍ—
———PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).7hCVE-2026-972067.5 ALT17.1%
——5NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.1hCVE-2026-114111—2.3%
——1sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.2dCVE-2026-1140426.5 MED16.0%
——5FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.1h