Log in Start free

Vulnerability · Published Mar 17, 2026 · Assigned by GitHub_M

CVE-2026-27459pyOpenSSL DTLS cookie callback buffer overflow

High 8.1

In plain English

A high-severity buffer overflow in pyopenssl from pyca. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.7%top 44.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23py3-openssl26.1.0-r0ALPINE-CVE-2026-27459
Alpine:v3.24py3-openssl26.1.0-r0ALPINE-CVE-2026-27459
Debian:12pyopensslno fix listedDEBIAN-CVE-2026-27459
Debian:13pyopenssl25.0.0-1+deb13u1DEBIAN-CVE-2026-27459
Debian:14pyopenssl26.0.0-1DEBIAN-CVE-2026-27459
PyPIpyopenssl26.0.0PYSEC-2026-2269
PyPIpyopenssl26.0.0GHSA-5pwr-322w-8jr4
Ubuntu:24.04:LTSpyopenssl23.2.0-1ubuntu0.1UBUNTU-CVE-2026-27459
Ubuntu:25.10pyopenssl25.0.0-1ubuntu0.1UBUNTU-CVE-2026-27459

Affected products (as reported)

VendorProductVersions
pyca pyopenssl >= 22.0.0, < 26.0.0

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References