- CVE-2026-19445: fix use-after-free in the ssl servername (SNI) callback - the callback reached its SSLContext through a borrowed pointer registered with OpenSSL, so once the callback switched SSLSocket.context to another context and nothing else referenced the original one, the freed object was used after the callback returned or on a later ClientHello. Look the context up from the connection instead and unregister the callback when the context is deallocated. Backported from upstream CPython (gh-156293, GH-158504).