From 285ae34c2a6daf35505c8e131cc81aa82398b1d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Sat, 15 Aug 2026 11:30:48 +0200
Subject: [PATCH 1/2] gh-155782: avoid a crash in `ssl.SSLObject.group` for
 session-less objects

---
 Lib/test/test_ssl.py                                     | 9 +++++++++
 .../2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst       | 2 ++
 Modules/_ssl.c                                           | 4 +++-
 3 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst

diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 2bba665d19343e..1adf67e0489cdc 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -1097,6 +1097,15 @@ def test_set_server_sigalgs(self):
         if CAN_IGNORE_UNKNOWN_OPENSSL_SIGALGS:
             self.assertIsNone(ctx.set_server_sigalgs('rsa_pss_rsae_sha256:?foo'))
 
+    @unittest.skipUnless(CAN_GET_SELECTED_OPENSSL_GROUP,
+                         "SSL library doesn't support getting selected group")
+    def test_no_session_group_does_not_crash(self):
+        # Ensure that .group() does not crash because of OpenSSL itself.
+        # See https://github.com/python/cpython/issues/155782.
+        ctx = ssl.create_default_context()
+        obj = ctx.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO())
+        self.assertIsNone(obj.group())
+
     def test_options(self):
         # Test default SSLContext options
         ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
diff --git a/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst b/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst
new file mode 100644
index 00000000000000..0382edfa35f045
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst
@@ -0,0 +1,2 @@
+:mod:`ssl`: prevent a crash in :meth:`SSLObject.group <ssl.SSLObject.group>`
+for session-less objects on OpenSSL 3.2 and later. Patch by Bénédikt Tran.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 9f8a6a58cd9327..cdf630f7735e13 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -2224,7 +2224,9 @@ _ssl__SSLSocket_group_impl(PySSLSocket *self)
 #if OPENSSL_VERSION_NUMBER >= 0x30200000L
     const char *group_name;
 
-    if (self->ssl == NULL) {
+    // OpenSSL issue: SSL_get0_group_name(...) crashes if no session exists.
+    // See https://github.com/openssl/openssl/issues/32379.
+    if (self->ssl == NULL || SSL_get_session(self->ssl) == NULL) {
         Py_RETURN_NONE;
     }
     group_name = SSL_get0_group_name(self->ssl);

From f6d577e4aeb246b5098f58c5b5c3f24f2a6079d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Sat, 15 Aug 2026 13:58:30 +0200
Subject: [PATCH 2/2] Update
 Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst

---
 .../next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst b/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst
index 0382edfa35f045..cafa887044fa44 100644
--- a/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst
+++ b/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst
@@ -1,2 +1,2 @@
-:mod:`ssl`: prevent a crash in :meth:`SSLObject.group <ssl.SSLObject.group>`
+:mod:`ssl`: prevent a crash in :meth:`~ssl.SSLSocket.group`
 for session-less objects on OpenSSL 3.2 and later. Patch by Bénédikt Tran.