Posted by Alan Coopersmith on Sep 30 Forwarded Message Subject: [Security-announce][CVE-2026-19445] Use-after-free of a server-side SSLContext when sni_callback switches contexts Date: Wed, 30 Sep 2026 16:10:08 +0000 From: Seth Larson Reply-To: security-sig () python org To: security-announce () python org There is a CRITICAL severity vulnerability affecting CPython. A remote, unauthenticated TLS client can make a...
CPython [CVE-2026-19445] Use-after-free of a server-side SSLContext when sni_callback switches contexts
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/1030
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497
Number: AL26-027 Date: October 28, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently…
Re: Information for Python users regarding eMudhra / emSign CA certificate security incident
Posted by Kevin Riggle on Oct 27 The discuss.python.org conversation on that issue has long since moved on, so asking here: The macOS remediation advice on the official…
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept…
Experts temper emergency-level alarms over critical Brotli defect
Alarm bells ratcheted up yet again about an AI-discovered vulnerability that could — if exploited in the wild — destabilize vast stretches of the internet. The critical…
[oss-security][CVE-2026-115557] Distrust compromised intermediate certificates in Python ssl module
Posted by Alan Coopersmith on Oct 24 Forwarded Message Subject: [Security-announce][CVE-2026-115557] Distrust compromised intermediate certificates in ssl module Date…
LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code
The JFrog Security Research team identified malicious code in `litellm` 1.107.0, a widely used Python interface and proxy for large language model providers. The payload…