pyOpenSSL: DTLS cookie callback buffer overflow

🗓️ 07 May 2026 18:00:30Reported by RedHatType

pyOpenSSL DTLS cookie callback may overflow 256-byte buffer due to missing bounds check when cookie is too long.

Reporter	Title	Published	Views	Family All 149
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	22 Jun 202614:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to pyOpenSSL	10 Jul 202606:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security bypass in pyOpenSSL [CVE-2026-27448, CVE-2026-27459]	21 May 202615:10	–	ibm
IBM Security Bulletins	Security Bulletin: pyOpenSSL TLS SNI Callback Exception Handling Flaw Allows Security Bypass	4 May 202612:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in pyOpenSSL bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging	18 May 202622:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities	6 May 202616:21	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cryptography, pyOpenSSL & golang affect IBM Storage Protect Plus	26 Jun 202606:08	–	ibm
ATTACKERKB	CVE-2026-27459	17 Mar 202623:34	–	attackerkb
AlpineLinux	CVE-2026-27459	17 Mar 202623:34	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in pyopenssl	24 Jun 202615:11	–	astralinux

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	python3.11-pyopenssl	24.1.0-2.el8pc	python3.11-pyopenssl-24.1.0-2.el8pc.noarch.rpm
Red Hat Enterprise Linux	9	noarch	python3.11-pyopenssl	24.1.0-2.el9pc	python3.11-pyopenssl-24.1.0-2.el9pc.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-27459
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst
github	www.github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408
github	www.github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-27459
cve	www.cve.org/CVERecord

19 Jul 2026 01:14Current

6Medium risk

Vulners AI Score6

CVSS 3.18.1 - 9.8

CVSS 49.2

EPSS0.00704

SSVC