Read the docs
TI-2026-21866 Aliases CVE-2026-27459GHSA-5pwr-322w-8jr4

pyOpenSSL DTLS cookie callback buffer overflow

Priority LOW 35CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 22 fixed, 9 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-120 and the CVSS impact.

Summary

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00748 55th percentileScored 2026-11-07
Fix Partial pyopenssl (pyca): 26.0.0pyopenssl (PyPI): 26.0.0Red Hat: 23 advisoriesRed Hat: 22 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pycapyopenssl22.0.0 to before 26.0.026.0.0Patch availableCNA
—pyopenssl (PyPI)22.0.0 to before 26.0.026.0.0Patch availableGHSA-5pwr-322w-8jr4
  • pyopenssl Vendorpyca Affected 22.0.0 to before 26.0.0 Fixed in 26.0.0 Patch available CNA
  • pyopenssl (PyPI) Vendor— Affected 22.0.0 to before 26.0.0 Fixed in 26.0.0 Patch available GHSA-5pwr-322w-8jr4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyopenssl:pyopenssl:*:*:*:*:*:*:*:*22.0.0 to before 26.0.0VulnerablePyopenssl
  • cpe:2.3:a:pyopenssl:pyopenssl:*:*:*:*:*:*:*:* Versions 22.0.0 to before 26.0.0 Vulnerable ·Pyopenssl

Remediation

  • Fix · CNA pyopenssl (pyca) Fixed in 26.0.0
  • Fix · GHSA-5pwr-322w-8jr4 pyopenssl (PyPI) Fixed in 26.0.0 Advisory →

Red Hat 23 advisories

  • RHSA-2026:87124 Released 2026-10-21 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9 +8
  • RHSA-2026:87120 Released 2026-10-21 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9 +8
  • RHSA-2026:68780 Released 2026-09-17 · Red Hat rating Critical
    Technical preview of the satellite/iop-vmaas-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
Show 20 more Red Hat advisories
  • RHSA-2026:59153 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +3
  • RHSA-2026:48758 Released 2026-07-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images jaeger-2.20.0-0.8.hum1@aarch64, jaeger-2.20.0-0.8.hum1@src, jaeger-2.20.0-0.8.hum1@x86_64
  • RHSA-2026:48085 Released 2026-07-29 · Red Hat rating Important
    Red Hat Quay 3.18.0
    • Red Hat Quay 3.18 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:24853 Released 2026-06-09 · Red Hat rating Important
    Red Hat Quay 3.15.5
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:22465 Released 2026-06-02 · Red Hat rating Important
    Red Hat Quay 3.17.2
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:21017 Released 2026-05-26 · Red Hat rating Important
    Red Hat Quay 3.14.8
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:19375 Released 2026-05-19 · Red Hat rating Important
    Red Hat Quay 3.16.4
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:14874 Released 2026-05-07 · Red Hat rating Important
    Satellite 6.16.8 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 candlepin-4.4.25-1.el8sat, candlepin-selinux-4.4.25-1.el8sat, python-markdown-3.8.2-1.el8pc +6
    • Red Hat Satellite 6.16 for RHEL 9 candlepin-4.4.25-1.el9sat, candlepin-selinux-4.4.25-1.el9sat, python-markdown-3.8.2-1.el9pc +6
  • RHSA-2026:14873 Released 2026-05-07 · Red Hat rating Important
    Satellite 6.17.8 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 candlepin-4.4.25-1.el9sat, candlepin-selinux-4.4.25-1.el9sat, python-markdown-3.8.2-1.el9pc +6
  • RHSA-2026:14835 Released 2026-05-07 · Red Hat rating Important
    Satellite 6.18.5 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 python3.12-django-4.2.30-1.el9pc, python3.12-markdown-3.8.2-1.el9pc, python3.12-pyOpenSSL-26.0.0-2.el9pc +1
  • RHSA-2026:13553 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8, registry.redhat.io/ansible-automation-platform-25/gateway-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +2
  • RHSA-2026:13545 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9 +11
  • RHSA-2026:13512 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.28-3.el8ap, automation-gateway-proxy-2.5.10-5.el8ap, automation-gateway-proxy-server-2.5.10-5.el8ap +19
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.28-3.el9ap, automation-gateway-proxy-2.6.14-2.el9, automation-gateway-proxy-server-2.6.14-2.el9 +19
  • RHSA-2026:13508 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.4-3.el10ap, receptorctl-1.6.4-3.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.11-2.el9ap, automation-controller-cli-4.7.11-2.el9ap, automation-controller-server-4.7.11-2.el9ap +25
  • RHSA-2026:11996 Released 2026-04-30 · Red Hat rating Important
    Red Hat Quay 3.9.21
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:11916 Released 2026-04-29 · Red Hat rating Important
    Red Hat Quay 3.10.21
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:11856 Released 2026-04-29 · Red Hat rating Important
    Red Hat Quay 3.12.17
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:10754 Released 2026-04-27 · Red Hat rating Important
    RHUI 4.11.4 security update - python-pyOpenSSL
    • RHUI 4 for RHEL 8 python-pyOpenSSL-24.1.0-2.el8ui, python3.11-pyOpenSSL-24.1.0-2.el8ui
  • RHSA-2026:8437 Released 2026-04-16 · Red Hat rating Important
    RHTAS 1.4 - GA Release of Model Transparency
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-rhel9
  • RHSA-2026:7224 Released 2026-04-09 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images pyOpenSSL-26.0.0-1.1.hum1@src, pyOpenSSL-doc-26.0.0-1.1.hum1@noarch@public-hummingbird-aarch64-rpms, pyOpenSSL-doc-26.0.0-1.1.hum1@noarch@public-hummingbird-x86_64-rpms +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ansible Automation Platform Ansible Core 2AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Update Infrastructure 4 for Cloud ProvidersAffectedNo fix planned: Will not fix
Red Hat Update Infrastructure 5AffectedNo fix yet
RHUI 4 for RHEL 8Fixed RHSA-2026:10754
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:13553
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:13512
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:13512
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:13545, RHSA-2026:87120
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:13508
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:59153, RHSA-2026:87124
Red Hat Hardened ImagesFixed RHSA-2026:48758, RHSA-2026:7224
Red Hat Quay 3.10Fixed RHSA-2026:11916
Red Hat Quay 3.12Fixed RHSA-2026:11856
Red Hat Quay 3.14Fixed RHSA-2026:21017
Red Hat Quay 3.15Fixed RHSA-2026:24853
Red Hat Quay 3.16Fixed RHSA-2026:19375
Red Hat Quay 3.17Fixed RHSA-2026:22465
Red Hat Quay 3.18Fixed RHSA-2026:48085
Red Hat Quay 3.9Fixed RHSA-2026:11996
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:14874
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:14874
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:14873
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:14835
Red Hat Satellite 6.19Fixed RHSA-2026:68780
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:8437
Not affected: 32 products
  • Confidential Compute Attestation
  • Lightspeed Core
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.18
  • Red Hat Quay 3.9
  • Red Hat Satellite 6
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27459
  2. 2026-10-03 Alias added: GHSA-5pwr-322w-8jr4
  3. 2026-10-22 Fix available: RHSA-2026:87124 · Red Hat
  4. 2026-10-22 Fix available: RHSA-2026:87120 · Red Hat
  5. 2026-10-22 Affected versions changed · Red Hat
  6. 2026-10-29 Affected versions changed · Red Hat
  7. 2026-10-30 Affected versions changed · Red Hat

References

Patch 1

Advisory 2

Other 2

  • TI-2026-48588 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVSS 4.0HIGH 8.7
  • TI-2026-48587 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees CVSS 4.0MEDIUM 6.9
  • TI-2026-48586 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences