CVE Intelligence
Analysis AI-assisted

CVE-2026-27459: pyOpenSSL DTLS cookie callback buffer overflow

pyOpenSSL versions from 22.0.0 up to but not including 26.0.0 can overflow an OpenSSL-provided buffer when a user-supplied cookie generation callback returns a value longer than 256 bytes. The record classifies the flaw as CWE-120 and reports a critical NVD base score of 9.8. Version 26.0.0 rejects cookie values that are too long, and the record does not list this CVE in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

pyOpenSSL is a Python wrapper around the OpenSSL library. According to the record, a user-provided callback passed to set_cookie_generate_callback that returns a cookie longer than 256 bytes causes pyOpenSSL to overflow a buffer provided by OpenSSL. The GitHub advisory and the NVD entry are the main sources cited here.

Impact

  • The record assigns CWE-120 (Classic Buffer Overflow).
  • NVD reports a base score of 9.8 with a network, low-complexity, no-privilege, no-user-interaction vector and high impact to confidentiality, integrity and availability.
  • The record also lists scores of 7.2 under a second CVSS framework and 8.1 from another provider.
  • The record does not describe the concrete consequences beyond the memory overflow, so the practical impact in a given deployment is unknown.

Affected products and versions

  • Pyca pyOpenSSL: from 22.0.0 up to but not including 26.0.0.
  • The record contains a second product entry, Pyopenssl Pyopenssl, with the same range.
  • Version 26.0.0 and later reject cookie values that are too long.

Exploitation status

The KEV field in the record is false, so this CVE is not listed in CISA KEV in the data provided. No confirmed exploitation appears in the sources consulted. The record gives an SSVC exploitation value of none, an automatable value of no, and an EPSS probability of 0.00916 with percentile 0.5982.

Remediation and mitigation

  • Upgrade pyOpenSSL to 26.0.0 or later, which the record identifies as the version that rejects overly long cookie values.
  • Review the fixing commit to confirm the change in your environment.
  • If an immediate upgrade is not possible, review whether your applications supply custom DTLS cookie callbacks and confirm how long their outputs can be. The record does not describe a formal workaround, so this is a general defensive suggestion.
  • The record lists many Red Hat errata and CSAF/VEX entries. Their contents were not provided, so this analysis does not rely on them for version or fix details.

Detection guidance

  • Inventory Python environments and container images that depend on pyOpenSSL, and record the installed version.
  • Include pyOpenSSL in dependency scanning and software bill of materials processes so that versions in the affected range are flagged.
  • Review application and service logs for unexpected crashes or memory-related errors in components that use DTLS with pyOpenSSL, and correlate them with recent deployments.

Limitations of the available information

  • The record does not describe the exact memory layout, the reachable code paths or the conditions required for exploitation beyond the callback behaviour.
  • The record does not state whether any public exploit exists, and this analysis does not assess one.
  • The record does not provide a workaround, so mitigation guidance is general.
  • Vendor advisories referenced in the record were not read for this analysis.

Frequently asked questions

Which pyOpenSSL versions are affected?

According to the record, versions from 22.0.0 up to but not including 26.0.0 are affected.

What should I do?

Upgrade pyOpenSSL to 26.0.0 or later, and review any custom DTLS cookie callbacks in your applications.

Is this CVE known to be exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.