Read the docs
TI-2026-21859 Aliases CVE-2026-27448GHSA-vp96-hxj8-p424

pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

Priority LOW 9CWE-636Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 1 fixed, 11 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Fix Partial pyopenssl (pyca): 26.0.0pyopenssl (PyPI): 26.0.0Red Hat: 1 advisoryRed Hat: 1 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pycapyopenssl0.14.0 to before 26.0.026.0.0Patch availableCNA
—pyopenssl (PyPI)0.14.0 to before 26.0.026.0.0Patch availableGHSA-vp96-hxj8-p424
  • pyopenssl Vendorpyca Affected 0.14.0 to before 26.0.0 Fixed in 26.0.0 Patch available CNA
  • pyopenssl (PyPI) Vendor— Affected 0.14.0 to before 26.0.0 Fixed in 26.0.0 Patch available GHSA-vp96-hxj8-p424

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyopenssl:pyopenssl:*:*:*:*:*:*:*:*0.14 to before 26.0.0VulnerablePyopenssl
  • cpe:2.3:a:pyopenssl:pyopenssl:*:*:*:*:*:*:*:* Versions 0.14 to before 26.0.0 Vulnerable ·Pyopenssl

Remediation

  • Fix · CNA pyopenssl (pyca) Fixed in 26.0.0
  • Fix · GHSA-vp96-hxj8-p424 pyopenssl (PyPI) Fixed in 26.0.0 Advisory →

Red Hat 1 advisory

  • RHSA-2026:7224 Released 2026-04-09 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images pyOpenSSL-26.0.0-1.1.hum1@src, pyOpenSSL-doc-26.0.0-1.1.hum1@noarch@public-hummingbird-aarch64-rpms, pyOpenSSL-doc-26.0.0-1.1.hum1@noarch@public-hummingbird-x86_64-rpms +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform Ansible Core 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 17.1AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 18.0AffectedNo fix yet: Fix deferred
Red Hat Quay 3AffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat Trusted Artifact SignerAffectedNo fix yet: Fix deferred
Red Hat Update Infrastructure 4 for Cloud ProvidersAffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:7224
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27448
  2. 2026-10-03 Alias added: GHSA-vp96-hxj8-p424

References

Patch 1

Advisory 2

Other 2

  • TI-2026-48588 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVSS 4.0HIGH 8.7
  • TI-2026-48587 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees CVSS 4.0MEDIUM 6.9
  • TI-2026-48586 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences