Mailman 3 September 2026 - Security-announce

[CVE-2026-19445] Use-after-free of a server-side SSLContext when sni_callback switches contexts
by Seth Larson Sept. 30, 2026

Sept. 30, 2026

There is a CRITICAL severity vulnerability affecting CPython. A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-19445 * https://github.com/python/cpython/pull/158504

1 0

[CVE-2026-19553] SSLContext.wrap_bio() missing validation of server_hostname parameter
by Seth Larson Sept. 30, 2026

Sept. 30, 2026

There is a HIGH severity vulnerability affecting CPython. `ssl.SSLContext.wrap_bio()` didn't require the `server_hostname` argument to not be `None` if `ssl.SSLContext.check_hostname` was set. Due to a missing parameter check in `SSLObject`, if the `server_hostname` argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with `SSLContext.check_hostname = True` and no `ValueError` being raised due to misconfiguration. If the program passes a `server_hostname` value that isn't an empty string or `None` to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-`None` and non-empty `server_hostname` value to `SSLContext.wrap_bio()`, `asyncio.create_connection()`, or `asyncio.loop.start_tls()` and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a `ValueError`, similar to `SSLContext.wrap_socket()`, when `server_hostname` isn't supplied. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-19553 * https://github.com/python/cpython/pull/158503

1 0

[CVE-2026-12345] Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
by Stan Ulbrych Sept. 29, 2026

Sept. 29, 2026

There is a MEDIUM severity vulnerability affecting CPython. The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-12345 * https://github.com/python/cpython/pull/157580

1 0

[CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to symlink
by Stan Ulbrych Sept. 14, 2026

Sept. 14, 2026

There is a HIGH severity vulnerability affecting CPython. In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-82049 * https://github.com/python/cpython/pull/157192 -- Stan Ulbrych (https://stan.ulbrych.org)

1 0

[CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None
by Petr Viktorin Sept. 11, 2026

Sept. 11, 2026

There is a MEDIUM severity vulnerability affecting CPython. When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-87910 * https://github.com/python/cpython/pull/157266

1 0