Segfault calling: `SSLObject.group()` before a session has been established
@picnixz is already working on this.
Since Aug 15, 2026.
- Dominant language
- Python
- Stars
- 77.2k
- Forks
- 35.9k
- PR merge metrics
- PR metrics pending
Description
Crash report
What happened?
Python 3.16.0a0 (heads/main-dirty:716cbae, Aug 13 2026, 11:31:04) [Clang 22.1.8 ] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
...
... context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
... ssl_object = context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO())
... print(ssl_object.group())
...
Segmentation fault
Here's the script:
import ssl
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ssl_object = context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO())
print(ssl_object.group())
LLDB Stack
(lldb) run
Process 92 launched: '/pfm/py/bin/python3' (aarch64)
Process 92 stopped
* thread #1, name = 'python3', stop reason = signal SIGSEGV: address not mapped to object (fault address=0x308)
frame #0: 0x0000fffff77c4e1c libssl.so.3`SSL_get0_group_name + 156
libssl.so.3`SSL_get0_group_name:
-> 0xfffff77c4e1c <+156>: ldr w1, [x0, #0x308]
0xfffff77c4e20 <+160>: ldr x0, [x2, #0x8]
0xfffff77c4e24 <+164>: adrp x16, 235
0xfffff77c4e28 <+168>: ldr x16, [x16, #0x670]
(lldb) bt
* thread #1, name = 'python3', stop reason = signal SIGSEGV: address not mapped to object (fault address=0x308)
* frame #0: 0x0000fffff77c4e1c libssl.so.3`SSL_get0_group_name + 156
frame #1: 0x0000fffff7903fc0 _ssl.cpython-316d-aarch64-linux-gnu.so`_ssl__SSLSocket_group_impl(self=0x0000fffff7a59b70) at _ssl.c:2230:18 [inlined]
frame #2: 0x0000fffff7903fac _ssl.cpython-316d-aarch64-linux-gnu.so`_ssl__SSLSocket_group(self=0x0000fffff7a59b70, _unused_ignored=0x0000000000000000) at _ssl.c.h:219:20
frame #3: 0x0000aaaaaaedb49c python3`method_vectorcall_NOARGS(func=0x0000fffff7a098b0, args=0x0000ffffffffcc40, nargsf=9223372036854775809, kwnames=0x0000000000000000) at descrobject.c:448:24
frame #4: 0x0000aaaaaaeb0b64 python3`_PyObject_VectorcallTstate(tstate=0x0000aaaaab7f98e0, callable=0x0000fffff7a098b0, args=0x0000ffffffffcc40, nargsf=9223372036854775809, kwnames=0x0000000000000000) at pycore_call.h:144:11
frame #5: 0x0000aaaaab2d7d64 python3`PyObject_Vectorcall(callable=<unavailable>, args=0x0000ffffffffcc40, nargsf=<unavailable>, kwnames=0x0000000000000000) at call.c:327:12 [inlined]
frame #6: 0x0000aaaaab2d7d54 python3`_Py_VectorCallInstrumentation_StackRefSteal(callable=<unavailable>, arguments=0x0000fffff7fe90f8, total_args=<unavailable>, kwnames=(bits = 1), call_instrumentation=false, frame=0x0000fffff7fe9098, this_instr=0x0000fffff7adb3d6, tstate=0x0000aaaaab7f98e0) at ceval.c:768:11
frame #7: 0x0000aaaaab28436c python3`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=<unavailable>, throwflag=<unavailable>) at generated_cases.c.h:1906:35
frame #8: 0x0000aaaaab270f54 python3`_PyEval_EvalFrame(tstate=0x0000aaaaab7f98e0, frame=0x0000fffff7fe9020, throwflag=0) at pycore_ceval.h:122:16 [inlined]
frame #9: 0x0000aaaaab270f2c python3`_PyEval_Vector(tstate=<unavailable>, func=<unavailable>, locals=0x0000fffff7acd610, args=<unavailable>, argcount=<unavailable>, kwnames=0x0000000000000000) at ceval.c:2172:12
frame #10: 0x0000aaaaab2708f0 python3`PyEval_EvalCode(co=0x0000fffff7c95a80, globals=0x0000fffff7acd610, locals=0x0000fffff7acd610) at ceval.c:679:21
Python side call site:
https://github.com/python/cpython/blob/5d91cf6487eb5aa37107598c792573f61ebe310f/Modules/_ssl.c#L2227-L2230
This looks pretty much like an OpenSSL bug.
The openssl docs say:
If SSL_get0_group_name() returns NULL, an error occurred; possibly no TLS session has been established
strongly implying that we should get NULL return rather than a null dereference.
There's a fix been added to pyopenssl:
https://github.com/pyca/pyopenssl/pull/1442#discussion_r2356925889
And I've just raised an openssl bug:
https://github.com/openssl/openssl/issues/32379
The intended behaviour is in the PR review comments:
What happens if the handshake hasn't been initiated or completed yet? If this returns NULL in that case, it would be good to mention it.
Good point, I'm not actually sure if it would return NULL or just break. I will make sure it returns NULL and update the doc to reflect it.
The Python function was introduced by:
commit 377b78761814e7d848361e642d376881739d5a29
Author: Ron Frederick <ronf@timeheart.net>
Date: Mon Jul 28 10:33:31 2025 -0700
gh-136306: Add support for getting and setting SSL groups (#136307)
tagging: @ronf
This issue has been in openssl 3.2 up to master.
While this is really an upstream issue, it seems reasonable to consider a python level fix, the conditions for this happening are quite easy to detect, and it means that python has a fix immediately?
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.16.0a0 (heads/main-dirty:716cbae, Aug 13 2026, 11:31:04) [Clang 22.1.8 ]
Linked PRs
- gh-155829
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.