{"answers":{"affected":"3 open source packages ship an affected version, including pyopenssl. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-27459 in the wild and no public exploit code.","fix":"Upgrade pyopenssl to 26.0.0 or later.","what":"CVE-2026-27459 is a high-severity memory corruption vulnerability in pyca pyopenssl, published on 17 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-27459 and fix it if it is affected.\n\nWhat it is: CVE-2026-27459 is a high-severity memory corruption vulnerability in pyca pyopenssl, published on 17 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-27459 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- pyopenssl (PyPI): affected from 22.0.0; fixed in 26.0.0\n- pyopenssl (PyPI): affected from 22.0.0; fixed in 26.0.0\n- pyopenssl (PyPI): affected from 22.0.0; fixed in 26.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-27459/ (Markdown: https://insights.sbomify.com/CVE-2026-27459/index.md)","id":"CVE-2026-27459","markdown":"https://insights.sbomify.com/CVE-2026-27459/index.md","name":"CVE-2026-27459","record":{"aliases":["AZL-80034","BELL-CVE-2026-27459","CLEANSTART-2026-HI15259","CLEANSTART-2026-ZF94018","DEBIAN-CVE-2026-27459","ECHO-913b-6868-0495","GHSA-5pwr-322w-8jr4","MINI-25hv-rvwp-679g","MINI-2qj9-4j2f-7928","MINI-98x6-5358-5hr9","MINI-f672-9c99-jx4f","MINI-h3qf-37p5-5xj4","MINI-h4wp-hjj2-rh3v","MINI-h6xh-mp3g-w2cq","MINI-hx5q-h4f6-5cq8","MINI-p2v6-cjwq-9qw3","MINI-q62c-xj6h-73gq","PYSEC-2026-2269","RHSA-2026:10754","ROOT-APP-PYPI-CVE-2026-27459","UBUNTU-CVE-2026-27459"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Python OpenSSL wrapper","requires_auth":"none","summary":"A buffer overflow in pyOpenSSL's DTLS cookie callback allows attackers to cause memory corruption or denial of service if custom callbacks return oversized cookies.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"pyopenssl","vendor":"pyopenssl"}],"cvss":{"score":7.2,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","version":"4.0"},"cwes":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"}],"description":"pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.","ecosystems":["PyPI","Red Hat:rhui:4::el8"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"pyOpenSSL DTLS cookie callback buffer overflow","id":"CVE-2026-27459","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":5,"n_references":3,"next":{"headline":"Tandoor Recipes Affected by Denial of Service via Recipe Import","id":"CVE-2026-27460"},"packages":[{"ecosystem":"PyPI","fixed":["26.0.0"],"introduced":["22.0.0"],"last_affected":[],"package":"pyopenssl","purl":null,"source":"GHSA-5pwr-322w-8jr4"},{"ecosystem":"PyPI","fixed":["26.0.0"],"introduced":["22.0.0"],"last_affected":[],"package":"pyopenssl","purl":"pkg:pypi/pyopenssl","source":"GHSA-5pwr-322w-8jr4"},{"ecosystem":"PyPI","fixed":["26.0.0"],"introduced":["22.0.0"],"last_affected":[],"package":"pyopenssl","purl":"pkg:pypi/pyopenssl","source":"PYSEC-2026-2269"},{"ecosystem":"Red Hat:rhui:4::el8","fixed":["0:24.1.0-2.el8ui"],"introduced":["0"],"last_affected":[],"package":"python-pyOpenSSL","purl":"pkg:rpm/redhat/python-pyOpenSSL","source":"RHSA-2026:10754"},{"ecosystem":"Red Hat:rhui:4::el8","fixed":["0:24.1.0-2.el8ui"],"introduced":["0"],"last_affected":[],"package":"python3.11-pyOpenSSL","purl":"pkg:rpm/redhat/python3.11-pyOpenSSL","source":"RHSA-2026:10754"}],"prev":{"headline":"LinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description","id":"CVE-2026-27458"},"products":["pyopenssl"],"published":"2026-03-17","related":[{"cvss_score":1.7,"headline":"pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback","id":"CVE-2026-27448","kev_date_added":null,"published":"2026-03-17"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-09-11","vendors":["pyca"]},"summary":"A buffer overflow in pyOpenSSL's DTLS cookie callback allows attackers to cause memory corruption or denial of service if custom callbacks return oversized cookies.","url":"https://insights.sbomify.com/CVE-2026-27459/"}