CVE-2026-27459

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to setcookiegeneratecallback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0....

CVE-2026-27459 pyOpenSSL DTLS cookie callback buffer overflow

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to setcookiegeneratecallback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0....

CVE-2026-27459 pyOpenSSL DTLS cookie callback buffer overflow

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to setcookiegeneratecallback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0....

CVE-2026-27448

CVE-2026-27448 is a pyOpenSSL vulnerability (SNI/TLSEXT callback) where an unhandled exception in set_tlsext_servername_callback could cause a connection to be accepted. IBM security notes reiterate that this flaw exists in pyOpenSSL versions prior to 26.0.0 and that starting with 26.0.0 unhandle...

CVE-2026-27448

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to "settlsextservernamecallback" raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback fo...

CVE-2026-27448

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to settlsextservernamecallback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for...

CVE-2026-27448 pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to settlsextservernamecallback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for...

a2grunnerp (>=0.1.0, <=0.1.8), a62-emotion (>=0.9.2, <=0.11.4) +1355 more potentially affected by CVE-2026-27448 via pyopenssl (>=0.14.0, <=25.3.0)

pyopenssl PYPI version =0.14.0, =0.1.0, =0.9.2, =2.3.36, =2.4.15, =0.1.17, =0.1.0, =0.3.2, =2.8.1, =0.4.0, =0.2.0, =0.1.1, =0.1.15 and more Source cves: CVE-2026-27448 Source advisory: MEND:CVE-2026-27448...

CVE-2026-27448 pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to settlsextservernamecallback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for...

CVE-2026-27448

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to settlsextservernamecallback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for...

pyOpenSSL security vulnerabilities

pyOpenSSL is an open-source Python library that encapsulates OpenSSL from the Python Cryptographic Authority project. Versions of pyOpenSSL from 0.14.0 to 26.0.0 contained security vulnerabilities. These vulnerabilities stemmed from unhandled exceptions in the settlsextservername Callback functio...

CVE-2026-27459: Buffer Copy without Checking Size of Input

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to setcookiegeneratecallback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0....

pyOpenSSL security vulnerabilities

pyOpenSSL is an open-source Python library developed by the Python Cryptographic Authority. Versions of pyOpenSSL from 22.0.0 to 26.0.0 had security vulnerabilities. These vulnerabilities were caused by an issue where the cookie value returned by setcookiegeneratecallback was too long, leading to...

pyOpenSSL DTLS cookie callback buffer overflow

If a user provided callback to setcookiegeneratecallback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Cookie values that are too long are now rejected...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow via the setcookiegeneratecallback function. An attacker can cause a buffer overflow by providing a callback that returns a cookie value greater than 256 bytes. Note: This is only exploitable if the application explicitly...

a2grunnerp (>=0.1.0, <=0.1.8), a62-emotion (>=0.9.2, <=0.11.4) +1011 more potentially affected by CVE-2026-27459 via pyopenssl (>=22.0.0, <=25.3.0)

pyopenssl PYPI version =22.0.0, =0.1.0, =0.9.2, =2.3.36, =2.4.15, =0.1.17, =0.1.0, =0.3.4, =2.17.2, =0.2.0, =0.1.1, =1.0.0, =4.2.1 and more Source cves: CVE-2026-27459 Source advisory: SNYK:PYTHON-PYOPENSSL-15674459...

a2grunnerp (>=0.1.0, <=0.1.8), a62-emotion (>=0.9.2, <=0.11.4) +1011 more potentially affected by CVE-2026-27459 via pyopenssl (>=22.0.0, <=25.3.0)

pyopenssl PYPI version =22.0.0, =0.1.0, =0.9.2, =2.3.36, =2.4.15, =0.1.17, =0.1.0, =0.3.4, =2.17.2, =0.2.0, =0.1.1, =1.0.0, =4.2.1 and more Source cves: CVE-2026-27459 Source advisory: OSV:GHSA-5PWR-322W-8JR4...

a2grunnerp (>=0.1.0, <=0.1.8), a62-emotion (>=0.9.2, <=0.11.4) +1011 more potentially affected by CVE-2026-27459 via pyopenssl (>=22.0.0, <=25.3.0)

pyopenssl PYPI version =22.0.0, =0.1.0, =0.9.2, =2.3.36, =2.4.15, =0.1.17, =0.1.0, =0.3.4, =2.17.2, =0.2.0, =0.1.1, =1.0.0, =4.2.1 and more Source cves: CVE-2026-27459 Source advisory: GHSA-5PWR-322W-8JR4...

Not Failing Securely ('Failing Open')

Overview Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' via the settlsextservernamecallback function. An attacker can bypass security-sensitive checks by causing an unhandled exception in the callback, which results in the connection being accepted. If a...

GHSA-VP96-HXJ8-P424 pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

If a user provided callback to settlsextservernamecallback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Unhandled exceptions now result in rejecting the...