* SECURITY UPDATE: use-after-free in the ssl servername (SNI) callback. _servername_callback() reached the Python SSLContext through a borrowed pointer registered with SSL_CTX_set_tlsext_servername_arg(). When the callback switched the connection to another context and nothing else kept the original one alive, a raising callback (PyErr_WriteUnraisable) or a second ClientHello (TLS 1.3 HelloRetryRequest, TLS 1.2 renegotiation) dispatched through the session_ctx used freed memory. - debian/patches/CVE-2026-19445.patch: backport of cpython ec44b5a3258cbda947d5e07242ee562ed05ef24b (gh-156293, GH-158504). The callback now takes strong references to ssl->ctx and its callback, the borrowed arg is no longer registered, and context_dealloc() unregisters the callback. Rewritten for 3.6's set_hostname field, WITH_THREAD guards and lack of Py_NewRef(); the tests use set_servername_callback() instead of sni_callback. - CVE-2026-19445 * SECURITY UPDATE: SSLContext.wrap_bio() did not require server_hostname when check_hostname was enabled, so an SSLObject whose handshake ran implicitly through read()/write() verified the certificate chain but never the peer's hostname, and reported no error. - debian/patches/CVE-2026-19553.patch: backport of cpython 5867d4e4ae6d1062352baf6b497a4026e8578ccf (gh-156793, GH-158503). wrap_bio() now validates its parameters as wrap_socket() does. It raises ValueError, as upstream 3.13+ does, instead of the 3.10 DeprecationWarning, which 3.6 ignores by default. The asyncio part does not apply to 3.6. - CVE-2026-19553