PT-2026-25840 · Openssl+3 · Openssl+3

Dark_Haxor · Published 2026-03-16 · Updated 2026-05-13 · CVE-2026-27459

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pyOpenSSL versions 22.0.0 through 25.3.0

Description pyOpenSSL is a Python wrapper around the OpenSSL library. If a user-provided callback to the set cookie generate callback function returned a cookie value exceeding 256 bytes, pyOpenSSL would cause a buffer overflow in an OpenSSL-provided buffer. Starting with version 26.0.0, pyOpenSSL rejects cookie values that are too long, mitigating the issue. The set cookie generate callback function is used to generate cookies for use with DTLS (Datagram Transport Layer Security).

Recommendations pyOpenSSL versions 22.0.0 through 25.3.0 should be updated to version 26.0.0 or later.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2026-27459

ECHO-913B-6868-0495

GHSA-5PWR-322W-8JR4

MGASA-2026-0074

OESA-2026-1729

OESA-2026-1730

OESA-2026-1731

OESA-2026-1734

OPENSUSE-SU-2026:10392-1

OPENSUSE-SU-2026:20419-1

RHSA-2026:10754

RHSA-2026:13508

RHSA-2026:13512

RHSA-2026:14835

RHSA-2026:14873

RHSA-2026:14874

RHSA-2026:7224

SUSE-SU-2026:1192-1

SUSE-SU-2026:20930-1

SUSE-SU-2026:20954-1

SUSE-SU-2026:20960-1

USN-8115-1

Affected Products

Linuxmint

Openssl

Ubuntu

Pyopenssl

References · 51

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27459.json · Exploit
• https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4 · Vendor Advisory
• https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27459 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27459 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20930-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1731 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0074 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8115-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-27459 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-27459 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27459 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27459 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8115-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27448 · Vendor Advisory