pyca pyopenssl vulnerabilities

Latest pyca pyopenssl CVEs

Newest publication first

1. CVE-2026-27459 pyOpenSSL DTLS cookie callback buffer overflow

   Published 2026-03-17

   High·CVSS 7.2 EPSS 0.80%

   pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to set_cookie_generate_callback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Start...

2. CVE-2026-27448 pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

   Published 2026-03-17

   Low·CVSS 1.7 EPSS 0.28%

   pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to set_tlsext_servername_callback raised an unhandled exception, this would result in a connection being accepted. If a user was relying o...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.