What happened
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
Affected versions
CPython: before 3.10.22 (python); 3.11.0 through before 3.11.17 (python); 3.12.0 through before 3.12.15 (python); 3.13.0 through before 3.13.16 (python); 3.14.0 through before 3.14.8 (python); 3.15.0a1 through before 3.15.0rc3 (python) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.