Use-after-free for server-side SSLContext with sni_callback #156293

This was assigned CVE-2026-19445 via our original GHSA report. Edited to fill in some details now that the fix has been released:

Summary

A remote, unauthenticated TLS client can make a Python TLS server dereference and call through a freed ssl.SSLContext object. Setting SSLContext.sni_callback registers the context with OpenSSL as the servername-callback argument without owning a reference, and nothing unregisters it when the context is deallocated; the underlying SSL_CTX outlives the Python object and OpenSSL still consults its callback on a later ClientHello of the same connection. A client provokes that later ClientHello at will (TLS 1.3 HelloRetryRequest, or renegotiation where the OpenSSL build permits it) and chooses its timing. Servers that select certificates from sni_callback in the documented way and do not keep their own reference to the callback-bearing context (for example gunicorn with an SNI-selecting ssl_context hook) crash or corrupt memory; on release builds the value used as the callback pointer has been observed to come from other clients' request bytes.

Impact

Use-after-free / memory corruption in the TLS server path, triggered pre-authentication on the first flight of a connection, with the timing of the use chosen by the peer. Observed outcomes depend on what reuses the freed allocation: deterministic crash, the stale callback slot has been seen as NULL (silently skipped), or as a pointer to an unrelated live object (invoked as the SNI callback), and as bytes from concurrent requests. The latter is what makes this a serious security issue.

Mitigation on unpatched versions

Keep a long-lived reference to every ssl.SSLContext that has sni_callback set (gunicorn: build the context once and return the same object from the hook); on OpenSSL 1.1.1 builds additionally set ssl.OP_NO_RENEGOTIATION on that (initial) context.

Credit

Discovered by Gregory P. Smith in collaboration with Claude and Anthropic Research

Linked PRs

• gh-156293: Use-after-free for server-side SSLContext with sni_callback #158504
• [3.13] gh-156293: Use-after-free for server-side SSLContext with sni_callback #158507
• [3.15] gh-156293: Use-after-free for server-side SSLContext with sni_callback (GH-158504) #158514
• [3.14] gh-156293: Use-after-free for server-side SSLContext with sni_callback (GH-158504) #158515
• [3.12] gh-156293: Use-after-free for server-side SSLContext with sni_callback #158517
• [3.11] gh-156293: Use-after-free for server-side SSLContext with sni_callback (GH-158504) #158523
• [3.10] gh-156293: Use-after-free for server-side SSLContext with sni_callback (GH-158504) #158524