PT-2026-25778 · Pyopenssl+3 · Pyopenssl+3

Leury Castillo · Published 2026-03-16 · Updated 2026-05-28 · CVE-2026-27448

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions pyOpenSSL versions 0.14.0 through 25.9.9

Description pyOpenSSL is a Python wrapper around the OpenSSL library. If a user-provided callback to the set tlsext servername callback function raised an unhandled exception, a connection would be accepted. This could allow bypassing security-sensitive behavior if a user relied on this callback. Starting with version 26.0.0, unhandled exceptions now result in rejecting the connection. The set tlsext servername callback function is used to set a callback that is invoked when the TLS server name extension is received during the TLS handshake. The username and password are not directly involved in this issue.

Recommendations pyOpenSSL versions 0.14.0 through 25.9.9 should be updated to version 26.0.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-636

Related Identifiers

CVE-2026-27448

ECHO-E106-5B29-8A6F

GHSA-VP96-HXJ8-P424

MGASA-2026-0074

OESA-2026-1729

OESA-2026-1730

OESA-2026-1731

OESA-2026-1732

OESA-2026-1733

OESA-2026-1734

OPENSUSE-SU-2026:10392-1

OPENSUSE-SU-2026:20419-1

RHSA-2026:7224

SUSE-SU-2026:1192-1

SUSE-SU-2026:1416-1

SUSE-SU-2026:1582-1

SUSE-SU-2026:20930-1

SUSE-SU-2026:20954-1

SUSE-SU-2026:20960-1

USN-8115-1

USN-8335-1

Affected Products

Linuxmint

Openssl

Ubuntu

Pyopenssl

References · 60

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27448.json · Exploit
• https://github.com/pyca/pyopenssl/security/advisories/GHSA-vp96-hxj8-p424 · Vendor Advisory
• https://github.com/pyca/pyopenssl/commit/d41a814759a9fb49584ca8ab3f7295de49a85aa0 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:20930-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27448 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27448 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27448 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8335-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27459 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-27448 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20419-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1192-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1732 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27448 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1734 · Vendor Advisory