A TLS server may experience an out-of-bounds read and a fixed-value out-of-bounds write on the server heap when calling the `SSL set SSL CTX()` function to switch a connection to a different SSL CTX during a handshake. This occurs if the replacement context recognizes more provider signature algorithms than the original context used to create the connection, as the internal array of per-slot certificate validity flags is not refreshed. A remote peer can trigger this by offering multiple signature algorithms, potentially corrupting heap metadata and causing a Denial of Service. This issue specifically affects provider signature algorithms usable from TLS 1.3.