CVE-2026-19445 – CPython

This CPython update fixes two serious flaws in the ssl and tarfile modules. CVE-2026-19445 has a CVSS score of 9.2, Critical severity. It is a use-after-free flaw in TLS servers whose sni_callback assigns a different context to SSLSocket.context while nothing else keeps the original SSLContext alive. A remote, unauthenticated TLS client can crash the server or force it to call through a freed pointer. This mostly affects servers that create an SSLContext for each connection or replace one while connections are open. It can lead to remote code execution and privilege escalation. TLS clients are not affected.

CVE-2026-82049 has a CVSS score of 8.4, High severity. In CPython 3.13 and earlier, the tarfile data and tar extraction filters can be bypassed by crafted archives that contain a hard link to a symbolic link. A malicious archive can change the permissions or modification time of a file outside the destination directory, or expose that file's contents inside the extracted tree. This can lead to privilege escalation. Until the patch is applied, servers should keep a reference to every SSLContext that sets sni_callback for as long as the server runs.