CVE-2026-19445

Executive Summary

CVE-2026-19445 is a use-after-free (CWE-416) vulnerability in an SSL/TLS server implementation in which a remote, unauthenticated TLS client can cause the server to crash or execute through a freed pointer. The flaw is triggered only under a specific server configuration: an sni_callback is set that assigns a different context to SSLSocket.context, and no other reference keeps the original ssl.SSLContext alive. Servers that create an SSLContext per connection, replace it while connections are open, or wrap their listening socket with it are the affected class; TLS clients are not affected. Impact is primarily availability loss (server termination), with a possible memory-safety consequence that could extend beyond a simple denial of service.

Technical Analysis

The vulnerability resides in the interaction between Python's ssl module server-side callback handling and object lifetime management. According to the NVD description, the sni_callback is the documented mechanism by which a server selects a certificate per server name. When that callback "assigns a different context to SSLSocket.context," the callback mutates the SSL socket's context pointer to point at a newly supplied ssl.SSLContext.

The defect is a classic lifecycle/ownership bug rather than a parsing or cryptographic flaw. If "nothing else keeps the original ssl.SSLContext alive," the original context object becomes eligible for garbage collection. Because native C resources associated with the context are destroyed while an SSLSocket may still hold or later follow the now-stale pointer, a subsequent access executes on freed memory — the defining signature of CWE-416 (Use-After-Free).

The trigger is entirely remote and requires no authentication: any TLS client that causes a server name indication (SNI) to be presented, thereby invoking the configured sni_callback, can set the vulnerable state. The NVD description explicitly defines the exposure envelope:

• Typical affected cases: servers that create an SSLContext per connection, or that replace the context while connections are open.
• Explicitly not affected: servers that wrap their listening socket with the context (this keeps the original context referenced for the server's lifetime).

No CVE record in the supplied data names a specific language runtime, version string, or vendor. The technical terminology (sni_callback, SSLSocket.context, ssl.SSLContext) is consistent with a Python ssl-module server implementation. "Insufficient technical detail is available" to attribute a specific product version range, and the Affected Versions list is empty in the supplied intelligence. Consequently, the vulnerable code path can only be described at the mechanism level: SNI-triggered context substitution plus missing strong reference equals premature free plus dangling pointer use.

This is an availability-first defect with a latent memory-corruption dimension. In a pure interpreter context the observable result is most often a hard crash of the server process. Where the freed object's memory is reused, the "call through a freed pointer" behavior described by NVD raises the theoretical possibility of control-flow diversion; however, no data in this record demonstrates exploitability beyond denial of service.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the exact conditions stated in the NVD description.

1. Reconnaissance / target identification. An attacker scans for TLS services (commonly port 443, or any TLS-wrapped listener) and identifies a target that is (a) SNI-aware and (b) configured with an sni_callback that swaps in a different context. Because the flaw depends on server-side configuration, the attacker's reconnaissance objective is to find services whose TLS handshakes exercise per-server-name certificate selection. Services that wrap their listening socket with ssl.SSLContext are not viable targets and can be ruled out.

2. Trigger of the flaw class. The attacker initiates a TLS handshake and supplies a server name indication. The server invokes its sni_callback. Per the vulnerable pattern, that callback assigns a different context to SSLSocket.context without any other code retaining the original ssl.SSLContext. Once the original context is no longer strongly referenced, it can be collected while connections remain active or while the socket still references the stale pointer.

3. Execution method at the vulnerability-class level. The attacker simply needs one or more valid TLS handshakes that satisfy the configuration precondition (per-connection context creation or live context replacement). No authentication, credentials, or malformed payload are required beyond a normal SNI-bearing ClientHello. The trigger is the configuration pattern plus the SNI-triggered context switch; the vulnerability class supplies the fatal follow-on access to freed memory ("call through a freed pointer" in the NVD wording). No specific payload bytes, function names, or wire encodings can be stated because the supplied description does not provide them.

4. Post-exploitation impact. Observed impact per NVD is that the server crashes or performs a call through a freed pointer. At minimum this yields denial of service — availability loss for all clients of the affected listener and any in-flight connections it served. If memory reuse after the free permits attacker-influenced data to occupy the freed region, the follow-on call could in principle be steered; no exploit-in-the-wild or PoC evidence exists in this record to substantiate escalation beyond crash/DoS, so this remains theoretical.

Impact Assessment

The attack prerequisite is remote and unauthenticated: a single external TLS client is sufficient, provided the server-side configuration precondition holds. Exposure is therefore high for affected deployments, but reachability is constrained by configuration — this reduces the probability of any given server being vulnerable and warrants the AC:H judgment reflected in the assessment vector (CVSS remains N/A per the supplied data; the vector listed is an analytical inference consistent with CWE-416 and remote DoS characteristics, not an authoritative score).

The dominant business impact is availability. Server process termination is directly service-disrupting: load balancers can convert repeated crashes into fleet-wide downgrade or outage, and long-lived TLS sessions may be dropped mid-operation. The "freed pointer" dimension introduces a confidentiality and integrity risk that cannot be quantified with the available data. Blast radius is bounded by how many listeners run the vulnerable configuration (per-connection SSLContext creation, or live context replacement). Environments that instead wrap their listening socket with a single context are explicitly out of scope. TLS clients are not affected, which limits any downstream/reverse-direction exposure.

Detection Guidance

Sigma Rule

title: Potential TLS Server Crash via SNI Callback Context Replacement (CVE-2026-19445)
id: 8f2c1a54-6d3b-4e91-9c77-0a1b2c3d4e5f
status: experimental
description: Detects a TLS server process terminating abruptly in proximity to SNI-triggered handshakes, consistent with use-after-free via sni_callback context replacement.
references:
  - CVE-2026-19445
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: process_termination
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/python'
      - '/python3'
  selection_crash:
    ExitStatus: 11
  timeframe: 5m
  condition: selection_proc and selection_crash
falsepositives:
  - Legitimate application restarts
  - OOM killer terminations
level: medium
tags:
  - attack.impact
  - attack.t1499
  - cve.2026.19445

YARA Rule

rule CVE_2026_19445_TLS_SNI_Context_Replacement
{
    meta:
        description = "Detects source code patterns that assign a new SSLContext to the SSL socket inside an SNI callback, a precondition for CVE-2026-19445 use-after-free"
        author = "valtersit.com Threat Intelligence"
        reference = "CVE-2026-19445"
        date = "2026-01-01"
        severity = "high"
    strings:
        $sni   = "sni_callback"
        $ctx1  = ".context =" nocase
        $ctx2  = "SSLContext"
        $sock  = "SSLSocket"
    condition:
        ($sni and $ctx2 and $ctx1) or ($sni and $sock and $ctx1)
}

Suricata IDS Rule

alert tcp any any -> any 443 (msg:"CVE-2026-19445 TLS SNI handshake - potential use-after-free trigger via sni_callback context replacement"; flow:established,to_server; content:"|16 03|"; depth:2; tls.sni; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-19445; sid:2026194450; rev:1;)

Elastic Detection

process where process.name in ("python", "python3") and
  event.type == "end" and
  process.exit_code == 11

Splunk SPL Query

index=os sourcetype=syslog ("python" OR "python3") ("Segmentation fault" OR "core dumped" OR "SIGSEGV")
| stats count min(_time) as first_seen max(_time) as last_seen by host process
| where count >= 3
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="cve-2026-19445,tls,availability">
  <rule id="2026194" level="10">
    <decoded_as>syslog</decoded_as>
    <match>python3</match>
    <regex>Segmentation fault|SIGSEGV|core dumped</regex>
    <description>CVE-2026-19445: TLS server process crashed - possible use-after-free via sni_callback context replacement</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_19445,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or affected version list is available in the supplied intelligence.

1. Immediate mitigations. Apply the workaround stated in the CVE record: keep a strong reference to every ssl.SSLContext that sets an sni_callback for the entire lifetime of the server. Audit TLS service code to eliminate the pattern in which an sni_callback assigns a different context to SSLSocket.context without another live reference retained. Where possible, restructure servers so a single long-lived context is stored in a module- or application-level variable. Prefer the explicitly unaffected architecture: wrap the listening socket with the SSLContext so the context is referenced for the server's lifetime. Add supervision/auto-restart for TLS listeners as a containment control (does not remediate memory-safety behavior). Note that TLS clients do not require changes.

2. Patch/upgrade steps. No patch is available from any tracked source; there is no fixed version to upgrade to. Monitor the upstream maintainer and NVD record for an updated ssl module release, then upgrade once a fix is published. Until then, treat the workaround above as the only known effective control.

3. Long-term hardening. Adopt explicit lifetime management for cryptographic context objects, including avoiding per-connection context creation and avoiding replacement of live contexts on open connections. Add memory-safety testing (fuzzing TLS handshake paths, especially SNI handling) to CI for server code in interpreted runtimes. Deploy resource and crash-rate monitoring on all TLS listeners, enforce rate limiting and connection caps on handshakes to reduce DoS amplification, and segregate TLS termination into isolated processes/containers so a crash cannot affect co-located services. Continue subscribing to vendor and NVD advisories for this CVE to shorten time-to-patch once a fix lands.

References

• NVD — CVE-2026-19445: https://nvd.nist.gov/vuln/detail/CVE-2026-19445
• MITRE CWE-416 — Use After Free: https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-19445 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS — CVE-2026-19445 (not yet scored at time of writing): https://api.first.org/data/v1/epss?cve=CVE-2026-19445

No public proof-of-concept, Nuclei template, or exploit code was identified. No exploit-in-the-wild evidence or named threat actor campaign is associated with CVE-2026-19445 in the available data.