CVE-2026-27459: pyOpenSSL DTLS cookie callback buffer overflow

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• pyopenssl pyopenssl22.0.0 and later · before 26.0.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (GitHub_M). Independent of NVD's CPE analysis and usually ahead of it.

• pyca pyopenssl

  • >= 22.0.0, < 26.0.0affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2018-1000807Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object han
  33Monitor
• CVE-2026-27448pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
  6Monitor

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.