- CVE-2026-19445: look up the SNI servername callback's SSLContext from the connection instead of the borrowed pointer registered with OpenSSL, and hold strong references to that context and to the callback while they are in use, so a callback that switches the socket to another context and drops the last reference to the context carrying it can no longer be reached through freed memory; the servername callback is also unregistered when a context is deallocated, since its SSL_CTX can outlive the Python object