From 295d0b4fad65fb3ec2a135cd90445f04f55e81b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 19 Oct 2026 12:26:38 -0700
Subject: [PATCH] gh-155782: avoid a crash in `ssl.SSLObject.group` for
 session-less objects (GH-155829) (cherry picked from commit
 a071788e3f438deb572b347cda5dbca7cd818c48)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
---
 Lib/test/test_ssl.py                                   | 10 ++++++++++
 .../2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst     |  2 ++
 Modules/_ssl.c                                         |  4 +++-
 3 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst

diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 7ae639d73031ff9..ba536222ea953bf 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -1127,6 +1127,16 @@ def test_set_server_sigalgs(self):
         if CAN_IGNORE_UNKNOWN_OPENSSL_SIGALGS:
             self.assertIsNone(ctx.set_server_sigalgs('rsa_pss_rsae_sha256:?foo'))
 
+    @unittest.skipUnless(CAN_GET_SELECTED_OPENSSL_GROUP,
+                         "SSL library doesn't support getting selected group")
+    def test_no_session_group_does_not_crash(self):
+        # Ensure that .group() does not crash because of OpenSSL itself.
+        # See https://github.com/python/cpython/issues/155782.
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = False
+        obj = ctx.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO())
+        self.assertIsNone(obj.group())
+
     def test_options(self):
         # Test default SSLContext options
         ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
diff --git a/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst b/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst
new file mode 100644
index 000000000000000..cafa887044fa443
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst
@@ -0,0 +1,2 @@
+:mod:`ssl`: prevent a crash in :meth:`~ssl.SSLSocket.group`
+for session-less objects on OpenSSL 3.2 and later. Patch by Bénédikt Tran.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index ed6ad559f1a37c7..21b031d0570f4a4 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -2224,7 +2224,9 @@ _ssl__SSLSocket_group_impl(PySSLSocket *self)
 #if OPENSSL_VERSION_NUMBER >= 0x30200000L
     const char *group_name;
 
-    if (self->ssl == NULL) {
+    // OpenSSL issue: SSL_get0_group_name(...) crashes if no session exists.
+    // See https://github.com/openssl/openssl/issues/32379.
+    if (self->ssl == NULL || SSL_get_session(self->ssl) == NULL) {
         Py_RETURN_NONE;
     }
     group_name = SSL_get0_group_name(self->ssl);