CVE-2026-27459

🗓️ 17 Mar 2026 23:34:28Reported by Debian Security Bug TrackerType

CVE-2026-27459: pyOpenSSL pre-26.0.0 overflows on cookie above 256 bytes; 26.0.0 rejects long cookies.

Reporter	Title	Published	Views	Family All 148
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	22 Jun 202614:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to pyOpenSSL	10 Jul 202606:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security bypass in pyOpenSSL [CVE-2026-27448, CVE-2026-27459]	21 May 202615:10	–	ibm
IBM Security Bulletins	Security Bulletin: pyOpenSSL TLS SNI Callback Exception Handling Flaw Allows Security Bypass	4 May 202612:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in pyOpenSSL bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging	18 May 202622:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities	6 May 202616:21	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cryptography, pyOpenSSL & golang affect IBM Storage Protect Plus	26 Jun 202606:08	–	ibm
ATTACKERKB	CVE-2026-27459	17 Mar 202623:34	–	attackerkb
AlpineLinux	CVE-2026-27459	17 Mar 202623:34	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in pyopenssl	24 Jun 202615:11	–	astralinux

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	11	any	pyopenssl	0	pyopenssl_0_any.deb
Debian	13	any	pyopenssl	25.0.0-1+deb13u1	pyopenssl_25.0.0-1+deb13u1_any.deb
Debian	14	any	pyopenssl	26.0.0-1	pyopenssl_26.0.0-1_any.deb
Debian	999	any	pyopenssl	26.0.0-1	pyopenssl_26.0.0-1_any.deb
Debian	12	any	pyopenssl	23.0.0-1	pyopenssl_23.0.0-1_any.deb

17 Mar 2026 23:34Current

4.6Medium risk

Vulners AI Score4.6

CVSS 3.18.1 - 9.8

CVSS 49.2

EPSS0.00704

SSVC