CVE-2026-27448

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27448
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27448.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27448
Aliases
Downstream
AZL (1)
BELL (1)
CGA (83)
CLEANSTART (14)
CLSA (5)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (7)
OESA (6)
openSUSE (2)
RHSA (1)
ROOT (1)
SUSE (13)
UBUNTU (1)
Related
CGA (1)
openSUSE (2)
SUSE (13)
Published
2026-03-17T23:24:30Z
Modified
2026-09-06T03:45:30Z
Severity
  • 1.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
Details

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to set_tlsext_servername_callback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-636"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27448.json"
}
References

Affected packages

Git / github.com/pyca/pyopenssl

Affected ranges

Type
GIT
Repo
https://github.com/pyca/pyopenssl
Events
Introduced
0146d447e63a737b4f05a1164d5950eff68543e7
Fixed
358cbf29c4e364c59930e53a270116249581eaa3
Fixed
d41a814759a9fb49584ca8ab3f7295de49a85aa0
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:pyopenssl:pyopenssl:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0.14"
        },
        {
            "fixed":  "26.0.0"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27448.json"