- CVE-2026-19445: ssl SNI callback no longer reaches the SSLContext through a borrowed pointer; it takes strong references to the socket's current context and callback, and context_dealloc() unregisters the callback (use-after-free when sni_callback switches contexts; backport of cpython ec44b5a3258c, gh-156293). - CVE-2026-19553: SSLContext.wrap_bio() now raises ValueError when check_hostname is enabled and no server_hostname is given, like wrap_socket() (backport of cpython 1697ea386c70, gh-156793).