CVE-2026-27459 pyOpenSSL DTLS cookie callback buffer overflow
A buffer overflow in pyOpenSSL's DTLS cookie callback allows attackers to cause memory corruption or denial of service if custom callbacks return oversized cookies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27459?
CVE-2026-27459 is a high-severity memory corruption vulnerability in pyca pyopenssl, published on 17 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.
Weakness: CWE-120
Which versions are affected by CVE-2026-27459?
3 open source packages ship an affected version, including pyopenssl. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyopenssl PyPI | From 22.0.0 | 26.0.0 |
pyopenssl PyPI | From 22.0.0 | 26.0.0 |
pyopenssl PyPI | From 22.0.0 | 26.0.0 |
Linux distribution packages (2)
python-pyOpenSSL Red Hat:rhui:4::el8 | All versions | 0:24.1.0-2.el8ui |
python3.11-pyOpenSSL Red Hat:rhui:4::el8 | All versions | 0:24.1.0-2.el8ui |
Products include Pyopenssl Pyopenssl.
How do I fix CVE-2026-27459?
Upgrade pyopenssl to 26.0.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-27459 being exploited?
There is no known exploitation of CVE-2026-27459 in the wild and no public exploit code.
Other vulnerabilities in pyca pyopenssl
Sources
Also known as AZL-80034, BELL-CVE-2026-27459, CLEANSTART-2026-HI15259, CLEANSTART-2026-ZF94018, DEBIAN-CVE-2026-27459, ECHO-913b-6868-0495 and 15 more.