PT-2026-25840 · Pypi · Pyopenssl

Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-27459

OSV

CVSS v4.0

7.2

7.2

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

If a user provided callback to

set cookie generate callback

returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer.

Cookie values that are too long are now rejected.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2026-27459

GHSA-5PWR-322W-8JR4

Affected Products

Pyopenssl

References · 5

• https://osv.dev/vulnerability/GHSA-5pwr-322w-8jr4 · Vendor Advisory
• https://github.com/pyca/pyopenssl · Note
• https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408 · Note
• https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst · Note
• https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4 · Note