CVE-2026-27459
Critical · CVSS 9.8pyOpenSSL — Buffer overflow via oversized cookie value in set_cookie_generate_callback (CWE-120)
- CVSS
- 9.8
- nvd
- EPSS
- 0.70%
- 50th pct
- KEV
- No
- Class
- oss containerizable
- CWE-120, CWE-120
Description
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.
Search profile — drives PoC discovery
Symbols set_cookie_generate_callbackset_cookie_verify_callbackDTLSv1_listenSSL_CTX_set_cookie_generate_cbcookiepyopensslOpenSSL.SSL
Keywords CVE-2026-27459pyOpenSSLGHSA-5pwr-322w-8jr4set_cookie_generate_callbackbuffer overflowcookie overflowpyopenssl 22.0.0pyopenssl 26.0.0pyca pyopensslDTLS cookie
Versions: >=22.0.0, <26.0.0
Affected packages
| PyPI | pyopenssl | 22.0.0 → 26.0.0 |
References
- https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst
- https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408
- https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4
- https://access.redhat.com/errata/RHSA-2026:10754
- https://access.redhat.com/errata/RHSA-2026:11856
- https://access.redhat.com/errata/RHSA-2026:11916
- https://access.redhat.com/errata/RHSA-2026:11996
- https://access.redhat.com/errata/RHSA-2026:13508
- https://access.redhat.com/errata/RHSA-2026:13512
- https://access.redhat.com/errata/RHSA-2026:13545
- https://access.redhat.com/errata/RHSA-2026:13553
- https://access.redhat.com/errata/RHSA-2026:14835
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T00:30:14.000Z