Skip to content

[3.10] gh-156293: Use-after-free for server-side SSLContext with sni_callback (GH-158504) #158524

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pablogsal merged 2 commits into from
Oct 1, 2026
Merged

[3.10] gh-156293: Use-after-free for server-side SSLContext with sni_callback (GH-158504) #158524

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7ab129e
[3.10] gh-156293: ssl: do not call the servername callback through a …
gpshead Aug 23, 2026
5ee05a9
[3.10] gh-156293: Document sni_callback dispatch after a context switch
gpshead Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
[3.10] gh-156293: Document sni_callback dispatch after a context switch
  • Loading branch information
@gpshead
gpshead committed Aug 24, 2026
commit 5ee05a95d2d14e2fb254a9650a83112a0204732d
11 changes: 11 additions & 0 deletions Doc/library/ssl.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1750,6 +1750,12 @@ to speed up repeated connections from the same clients.
:class:`SSLContext` representing a certificate chain that matches the server
name.

If the callback assigns a new context to :attr:`SSLSocket.context`, any
further ClientHello message on the same connection (for example after a
TLS 1.3 HelloRetryRequest) is dispatched to the new context's
*sni_callback*, if it has one; the original callback is not called again
for that connection.

Due to the early negotiation phase of the TLS connection, only limited
methods and attributes are usable like
:meth:`SSLSocket.selected_alpn_protocol` and :attr:`SSLSocket.context`.
Expand All @@ -1773,6 +1779,11 @@ to speed up repeated connections from the same clients.

.. versionadded:: 3.7

.. versionchanged:: next
After the callback assigns a new :attr:`SSLSocket.context`, later
ClientHello messages on the connection are dispatched to the new
context's *sni_callback*.

.. attribute:: SSLContext.set_servername_callback(server_name_callback)

This is a legacy API retained for backwards compatibility. When possible,
Expand Down
Loading