CVE-2026-27448: pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
Analyzed
AliasesSUSE-SU-2026:1416-1SUSE-SU-2026:1582-1SUSE-SU-2026:3424-1GHSA-vp96-hxj8-p424PYSEC-2026-2268UBUNTU-CVE-2026-27448USN-8335-1DEBIAN-CVE-2026-27448CGA-24v8-7jq6-xgf6CGA-3vcx-hqj5-4749CGA-4c88-m7r8-hp53CGA-62jp-wr7j-8p86CGA-6cw9-jw5m-3j56CGA-7rgm-69m6-jc3qCGA-87fv-pfhr-6g8xCGA-94x7-fxfc-39rpCGA-97vh-wqp4-9xrwCGA-9w87-5p6h-jgh5CGA-f66p-r5p7-gj8jCGA-fmcq-72p6-f8x7CGA-fvmp-g46q-rwr2CGA-fvp4-fppm-v69pCGA-gm8r-9cqc-mvhpCGA-gq7p-j83r-jq3xCGA-jx8q-hmcq-vx9vCGA-mf69-hjqm-568vCGA-phmh-82rx-gfh5CGA-qh3c-q9jh-hm3mCGA-rxp8-c2x3-fw2vCGA-vw9m-8c2g-mpvcCGA-vx33-r88h-r7f4CGA-ww6r-7fvj-rp3fCGA-x2xr-7q3c-qfwrCGA-x9pf-xv26-fq2pCGA-xcj4-p88j-gp28CGA-228x-4c95-xg8gCGA-237r-c5h7-m2j3CGA-33r2-73gg-58qcCGA-3cwf-8v6f-f7hgCGA-3w5f-x58f-6rhwCGA-4hwp-h35m-h59vCGA-4jfc-3ghg-8hrcCGA-4jvx-xw8x-5fpwCGA-5589-7qww-8975CGA-58fh-gv4v-g6g6CGA-5mcp-5qhh-v3rpCGA-5vqc-pwgq-hgg9CGA-5xpf-v94w-h72rCGA-666g-75rw-8qfmCGA-7f7r-hrmj-pg92CGA-7rh5-9939-68q9CGA-83hf-wq85-hf75CGA-8c8v-mq92-w2wqCGA-8v9v-fj7v-pp3fCGA-8v9x-c2x3-vvr3CGA-9h2m-ww25-fm6rCGA-9v9r-9wv7-68h4CGA-c23v-2788-6j6fCGA-chfg-g7h7-cvf2CGA-cmw4-gpcr-pwx6CGA-g7mg-vrr4-8rmcCGA-h6f7-fg28-mq95CGA-hgjc-37ch-96x4CGA-hgvv-f735-4c3jCGA-hrmv-c4j8-45j2CGA-j62w-gxgc-296vCGA-j7cq-82j8-hr3pCGA-jcm4-6397-m2vgCGA-jm23-3g5p-699cCGA-jvp9-jm52-8c5rCGA-m6wf-jj3c-2c8gCGA-m7j2-jvmh-8x78CGA-mfq8-j67q-7p76CGA-pxg2-3gm4-c4mhCGA-qfp8-gr7m-xgc6CGA-qh6g-6xwv-9qr3CGA-qwr6-4j2j-8j6vCGA-qxqp-5w45-jjg2CGA-r3gp-w4vm-824rCGA-r3mv-r5x2-25m4CGA-r5v9-987r-6jggCGA-r8qv-pwfq-vmgvCGA-rjr6-wxrx-543jCGA-rqvx-rqrc-h823CGA-rvvf-4774-c62hCGA-w475-r643-qx59CGA-w692-mqff-73f5CGA-x47g-g26x-3v62CGA-x68f-g746-crjhCGA-xhg2-fh9c-5v4fCGA-xxmw-xgcr-xmg8ALPINE-CVE-2026-27448
Published 17-03-2026Last modified 18-03-2026
Vulnerability summary
CVE-2026-27448 is a medium (CVSS 5.3) Not Failing Securely vulnerability in pyca pyopenssl. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.3% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 1.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
0.26%
0%100%
Low · -0.14 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 10 · Related 10Timeline
- 17-03-2026PublishedVulnerability first disclosed.
- 18-03-2026Last modifiedVulnerability information updated.
Description
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.
CVSS metrics
10 scores · 8 sources · 2 versionsLow 1.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:USources5 sources · 1.7–6.3
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST1.7LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NSourcesAll 5 agree
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
Decrease -0.14 pp
From 0.39% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard40 products
- airflow-2< 2.11.2-r2
- airflow-3< 3.1.8-r8
- authentik< 2026.2.1-r4
- authentik-fips< 2026.2.1-r3
- awx< 24.6.1-r31
Wolfi13 products
- airflow-3< 3.1.8-r8
- az< 2.84.0-r3
- datadog-agent-7.72-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.73-core-integrations< 7.73.3-r23
- datadog-agent-7.74-core-integrations< 7.74.1-r24
Suse6 products
- python-pyOpenSSL&distro=SUSE Linux Enterprise Micro 5.2< 19.0.0-150300.3.3.1
- python-pyOpenSSL&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 17.1.0-4.32.1
- python3-pyOpenSSL&distro=SUSE Linux Enterprise Micro 5.3< 21.0.0-150400.22.1
- python3-pyOpenSSL&distro=SUSE Linux Enterprise Micro 5.4< 21.0.0-150400.22.1
- python3-pyOpenSSL&distro=SUSE Linux Enterprise Micro 5.5< 21.0.0-150400.22.1
Alpine1 product
- py3-openssl< 26.1.0-r0
Debian1 product
- pyopensslAll versions (No fix recorded) | < 25.0.0-1+deb13u1 | < 26.0.0-1
Pyca1 product
- pyopenssl≥ 0.14.0, < 26.0.0
Pyopenssl1 product
- pyopenssl≥ 0.14, < 26.0.0
PyPI1 product
- pyopenssl≥ 0.14.0, < 26.0.0 | ≥ 0.14, < 26.0.0
Ubuntu1 product
- pyopenssl< 21.0.0-1ubuntu0.1 | < 23.2.0-1ubuntu0.1 | < 25.0.0-1ubuntu0.1 | < 0.15.1-2ubuntu0.2+esm1 | < 17.5.0-1ubuntu1+esm1 | < 19.0.0-1ubuntu0.1~esm1
9 vendors · 65 products
References
17 links- github.com/pyca/pyopenssl/security/advisories/GHSA-vp96-hxj8-p424X Refsource CONFIRMWEBAdvisoryREPORTVendor Advisory
- github.com/pyca/pyopenssl/commit/d41a814759a9fb49584ca8ab3f7295de49a85aa0X Refsource MISCWEBFIXPatch
- github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rstX Refsource MISCWEBAdvisoryRelease Notes
- github.com/pyca/pyopensslPACKAGE
