CVE-2026-27459

HIGH EPSS 39.0%
Published Mar 18, 20263mo ago · Modified Jun 17, 20262w ago
7.2 CVSS 4.0
High
Find Similar
Published Mar 18, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.

CVSS Details

Base Score
7.2
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
39.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-120

Affected Products 1

VendorProductVersionRange
pyopensslpyopenssl*≥22.0.0  –  <26.0.0

References 3

  • github.com https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst
    Release Notes
  • github.com https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408
    Patch
  • github.com https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4
    Vendor Advisory

Remediation

  • github.com https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408
    Patch