* SECURITY UPDATE: use-after-free of a server-side SSLContext when an sni_callback switches the connection to another context. _servername_callback() in Modules/_ssl.c reached the Python SSLContext through the borrowed pointer stored with SSL_CTX_set_tlsext_servername_arg() and held no reference to it. When the callback assigned a different context to SSLSocket.context and nothing else kept the original alive, the C code then used freed memory: in PyErr_WriteUnraisable() after a raising callback, and when OpenSSL re-entered the callback through the connection's session_ctx on a second ClientHello (e.g. after a TLS 1.3 HelloRetryRequest). Remote, unauthenticated, before the handshake completes. - debian/patches/CVE-2026-19445.patch: backport of cpython 46133cd57d309652139ada74014aca7665ac552b (gh-156293), which takes the context from the socket and holds strong references to it and to its sni_callback while the callback runs, no longer registers the borrowed servername arg, and clears the servername callback in context_dealloc(). Py_NewRef()/Py_XNewRef() are spelled as Py_INCREF()/Py_XINCREF() and the get_state_ctx() type assert as PySSLSocket_Check(), since 3.9 has neither. Includes upstream's regression tests in Lib/test/test_ssl.py. - CVE-2026-19445 * SECURITY UPDATE: SSLContext.wrap_bio() did not require server_hostname when check_hostname was True (CWE-295). SSLObject._create() in Lib/ssl.py skipped the parameter checks wrap_socket() performs, so a memory-BIO SSLObject - and asyncio loop.start_tls() / create_connection(sock=...) through asyncio/sslproto.py - created with no server_hostname verified the certificate chain but silently skipped hostname verification. - debian/patches/CVE-2026-19553.patch: backport of cpython 966bf426d0b6c31c1b0a255ff14a17143a466ced (gh-156793), which adds _check_sslobject_params() and calls it from both SSLObject._create() and SSLSocket._create(), so wrap_bio() now raises ValueError like wrap_socket(). Includes upstream's tests in Lib/test/test_ssl.py; the asyncio tests are adapted to 3.9's _SSLPipe-based sslproto. - CVE-2026-19553