* SECURITY UPDATE: use-after-free of a server-side ssl.SSLContext when an sni_callback switches SSLSocket.context. _servername_callback() in Modules/_ssl.c reached the Python SSLContext through the borrowed pointer registered with SSL_CTX_set_tlsext_servername_arg(); once the callback switched the socket to another context and nothing else referenced the original one, PyErr_WriteUnraisable() after a raising callback, and a second ClientHello (e.g. after a TLS 1.3 HelloRetryRequest) dispatched through the surviving session_ctx, used freed memory. The callback now takes the socket's current context and holds strong references to it and to its callback, and context_dealloc() unregisters the callback. - debian/patches/CVE-2026-19445.patch: backport of cpython ec44b5a3258cbda947d5e07242ee562ed05ef24b (3.10 branch, gh-156293, GH-158504), adapted to the 3.7 C API (Py_INCREF/Py_XINCREF instead of Py_NewRef/Py_XNewRef, no get_state_ctx()). Both upstream regression tests are carried; the unraisable-exception check reads sys.stderr, as 3.7 has no support.catch_unraisable_exception(). - CVE-2026-19445 * SECURITY UPDATE: ssl.SSLContext.wrap_bio() did not require server_hostname when check_hostname was enabled, so an SSLObject (memory-BIO) client, and asyncio's start_tls()/create_connection( server_hostname=''), verified the certificate chain but silently never the peer's hostname. Lib/ssl.py now validates the wrap_bio() parameters with the same _check_sslobject_params() helper as wrap_socket() and raises ValueError("check_hostname requires server_hostname"). - debian/patches/CVE-2026-19553.patch: backport of cpython PR 158516 (3.11 branch, commits 5de40fab6050 and b8e971fc1615, gh-156793, GH-158503). Lib/ssl.py is upstream's; the asyncio tests were adapted because 3.7 calls wrap_bio() lazily from connection_made(). - CVE-2026-19553