* SECURITY UPDATE: use-after-free of a server-side SSLContext when the servername (SNI) callback switches contexts. _servername_callback in Modules/_ssl.c reached the Python SSLContext through a borrowed pointer stored with SSL_CTX_set_tlsext_servername_arg(). When the callback assigned another context to SSLSocket.context and nothing else kept the original alive, C code later used freed memory: in PyErr_WriteUnraisable() after a raising callback, and on a second ClientHello (TLS 1.3 HelloRetryRequest) that falls back to the original SSL_CTX through session_ctx. - debian/patches/CVE-2026-19445.patch: backport of cpython ec44b5a3258cbda947d5e07242ee562ed05ef24b (gh-156293, GH-158504), adapted to 2.7's set_servername_callback()/set_hostname. The callback now holds strong references to the socket's current context and its callback, the borrowed servername arg is no longer registered, and context_dealloc() unregisters the callback. The upstream MemoryBIO tests are rewritten over socket.socketpair(). - CVE-2026-19445