Openssl · Openssl · CVE-2026-27459
**Name of the Vulnerable Software and Affected Versions**
pyOpenSSL versions 22.0.0 through 25.3.0
**Description**
pyOpenSSL is a Python wrapper around the OpenSSL library. If a user-provided callback to the `set cookie generate callback` function returned a cookie value exceeding 256 bytes, pyOpenSSL would cause a buffer overflow in an OpenSSL-provided buffer. Starting with version 26.0.0, pyOpenSSL rejects cookie values that are too long, mitigating the issue. The `set cookie generate callback` function is used to generate cookies for use with DTLS (Datagram Transport Layer Security).
**Recommendations**
pyOpenSSL versions 22.0.0 through 25.3.0 should be updated to version 26.0.0 or later.