CVE-2026-27459: pyOpenSSL DTLS cookie callback buffer overflow
Modified
AliasesGHSA-5pwr-322w-8jr4PYSEC-2026-2269RHSA-2026:10754UBUNTU-CVE-2026-27459DEBIAN-CVE-2026-27459CGA-2fcg-2mj9-4rq3CGA-2p8v-hwg7-jffqCGA-2xm6-wqfj-h9g8CGA-33qj-vgj7-49xgCGA-36gx-rc63-p5f5CGA-44vj-c62w-9pqfCGA-4fwj-3895-qx4fCGA-5ggx-c34c-xpgrCGA-699c-f5fr-h896CGA-6hcj-qcpc-xjx2CGA-6vfp-34gj-2w5cCGA-725q-j3mv-j9j7CGA-932w-mhxv-2j5qCGA-9rqh-rmh3-f67gCGA-c6x8-pqqf-f5w4CGA-chpv-r9xg-7gqfCGA-fw2g-8mwr-q493CGA-h7c3-3f9g-g8qcCGA-h94w-h435-7mfrCGA-jgvf-26h6-gg4vCGA-jmgh-2c6x-f7x5CGA-m3rv-f3qx-ch2gCGA-pqh8-hj43-3vqhCGA-r37p-p6jp-c5qxCGA-r6qf-j6c6-8jcwCGA-wwxx-gx2h-xxvcCGA-xwvc-vmvp-87j2CGA-279r-q8hv-8qp7CGA-2pvq-r3r5-324xCGA-2vj4-g682-rgxcCGA-39vm-28v3-h2q9CGA-3g6f-63j4-rpvqCGA-3jfg-537w-w8h5CGA-3v74-h6q3-3v6jCGA-43fh-pq9x-rpwmCGA-4657-hpfx-wm5hCGA-5m2q-6rpj-mwghCGA-5mv9-f688-x7q9CGA-5wcp-5gqf-mq9vCGA-6jgw-xhgq-7574CGA-6mhx-hqv8-8839CGA-6w36-85qx-p9gxCGA-6wvv-994h-5cc3CGA-7hv7-6w6q-ch85CGA-7xpf-8jmg-p3h9CGA-833q-3f77-4ff2CGA-8558-v7f7-xjxrCGA-85v9-95xx-2x4rCGA-8r6q-2rxf-2pf4CGA-925m-cpv9-7h56CGA-97r8-89rv-xxj9CGA-9mjw-wv36-2hhwCGA-cf8g-pp49-rgqjCGA-cj49-xqvg-cr36CGA-cw88-m7qv-62cwCGA-f64c-5gc6-x94qCGA-fj69-m73v-v4xrCGA-gm78-j82r-h3fxCGA-gq4f-2p7h-6wwmCGA-gxhh-xvg2-fm8wCGA-h2fr-g857-ffpqCGA-h98c-vxhf-rcq3CGA-hqv7-27cp-qxrmCGA-j494-5x9j-qf6fCGA-jjjx-fhr3-228jCGA-jmwj-j3hc-7q87CGA-m2v7-h54p-64vpCGA-mc2v-hjxx-9v5hCGA-mh4h-c64x-wjx9CGA-mrpx-g6m8-h95jCGA-p8mv-7p4p-g936CGA-pcvc-jfmf-jcg3CGA-q43w-xpx4-mg56CGA-r3jj-mjgx-c59fCGA-r8mg-3hv3-fcp8CGA-rqf2-4h77-27jcCGA-v2vp-63qv-qv48CGA-vcfv-vp8m-6r6pCGA-vq2r-2fxr-37xmCGA-vqcg-qqf4-3v43CGA-w8fm-hx84-wjcwCGA-w8x6-hpp3-3vvvCGA-wghp-23rc-9xj4ALPINE-CVE-2026-27459
Published 17-03-2026Last modified 11-09-2026
Vulnerability summary
CVE-2026-27459 is a critical (CVSS 9.8) vulnerability in pyca pyopenssl. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 54.9% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 7.2 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.75%
0%100%
Low · -0.13 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 22 · Related 16MGASA-2026-0074OPENSUSE-SU-2026:10392-1OPENSUSE-SU-2026:20419-1RHSA-2026:13508RHSA-2026:13512RHSA-2026:14835RHSA-2026:14873RHSA-2026:14874RHSA-2026:48758RHSA-2026:7224SUSE-EL-9-CLIENT-TOOLS-2026-2255SUSE-RU-2026:2769-1SUSE-SU-2026:1192-1SUSE-SU-2026:20930-1SUSE-SU-2026:20954-1SUSE-SU-2026:20960-1SUSE-SU-2026:4580-1SUSE-SU-2026:4581-1SUSE-SU-2026:4582-1SUSE-SU-2026:4583-1SUSE-SU-2026:4584-1SUSE-SU-2026:4585-1CGA-QV3Q-JPXP-CPMXUSN-8115-1
Timeline
- 17-03-2026PublishedVulnerability first disclosed.
- 11-09-2026Last modifiedVulnerability information updated.
Description
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.
CVSS metrics
12 scores · 9 sources · 2 versionsHigh 7.2Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:USources5 sources · 7.2–9.2
- OSV · UbuntuEcosystem advisory · calculated9.2CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated9.2CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated9.2CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST7.2HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources7 sources · 8.1–9.8
- CVE.orgCNA8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · PypiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.75%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
Decrease -0.13 pp
From 0.88% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard40 products
- airflow-2< 2.11.2-r2
- airflow-3< 3.1.8-r8
- authentik< 2026.2.1-r4
- authentik-fips< 2026.2.1-r3
- awx< 24.6.1-r31
Wolfi13 products
- airflow-3< 3.1.8-r8
- az< 2.84.0-r3
- datadog-agent-7.72-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.73-core-integrations< 7.73.3-r23
- datadog-agent-7.74-core-integrations< 7.74.1-r24
Redhat2 products
- python-pyOpenSSL< 0:24.1.0-2.el8ui
- python3.11-pyOpenSSL< 0:24.1.0-2.el8ui
Alpine1 product
- py3-openssl< 26.1.0-r0
Debian1 product
- pyopensslAll versions (No fix recorded) | < 25.0.0-1+deb13u1 | < 26.0.0-1
Pyca1 product
- pyopenssl≥ 22.0.0, < 26.0.0
Pyopenssl1 product
- pyopenssl≥ 22.0.0, < 26.0.0
PyPI1 product
- pyopenssl≥ 22.0.0, < 26.0.0
Ubuntu1 product
- pyopenssl< 23.2.0-1ubuntu0.1 | < 25.0.0-1ubuntu0.1
9 vendors · 61 products
References
36 links- github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4X Refsource CONFIRMWEBAdvisoryARTICLEREPORTVendor Advisory
- github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408X Refsource MISCWEBFIXARTICLEPatch
- github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rstX Refsource MISCWEBAdvisoryARTICLERelease Notes
Show all 36 references
- github.com/pyca/pyopensslPACKAGE
