Vulnerability Description
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pyopenssl | Pyopenssl | >= 22.0.0, < 26.0.0 |
Related Weaknesses (CWE)
References
- https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/Release Notes
- https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd40Patch
- https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4Vendor Advisory
FAQ
What is CVE-2026-27459?
CVE-2026-27459 is a vulnerability with a CVSS score of 9.8 (CRITICAL). pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value ...
How severe is CVE-2026-27459?
CVE-2026-27459 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-27459?
Check the references section above for vendor advisories and patch information. Affected products include: Pyopenssl Pyopenssl.