Buffer overflow in Pyca Pyopenssl

CVE-2026-27459

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would…

Vulnerability class: Buffer Overflow

EPSS: 0.000 (8.1th percentile) — read the EPSS interpretation.

Affected products

Pyca Pyopenssl — versions >= 22.0.0, < 26.0.0

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

References

https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4 (x_refsource_CONFIRM)
https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408 (x_refsource_MISC)
https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst (x_refsource_MISC)