CVE-2026-27448Disclosure(pyopenssl / pyopenssl)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch pyopenssl pyopenssl systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

pyopenssl CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/pyca/pyopenssl/commit/d41a814759a9fb49584ca8ab3f7295de49a85aa0

Vendor / third-party advisories

https://github.com/pyca/pyopenssl/security/advisories/GHSA-vp96-hxj8-p424

Other references

https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst#L27

Weakness type (CWE)

CWE-636

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

pyopenssl

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-03-18); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

pyopenssl

Products

pyopenssl

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-18	2	Disclosure1General1
2026-03-19	1	Disclosure1
2026-03-21	1	Patch1

Full discourse4 posts

Open Source Security mailing list@oss_security202d
Patch
2 CVEs fixed in pyOpenSSL 26.0.0 https://www.openwall.com/lists/oss-security/2026/03/20/5 CVE-2026-27459: Buffer overflow if a DTLS cookie callback returned a cookie longer than DTLS1_COOKIE_LENGTH bytes CVE-2026-27448: set_tlsext_servername_callback exceptions were silently swallowed and handshake would proceed
Post summary
The note announces that CVE-2026-27459 and CVE-2026-27448 have been fixed in pyOpenSSL 26.0.0, providing brief technical details of the issues.
02072654
4.4K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds205d
Disclosure
CVE-2026-27448 Security Bypass in pyOpenSSL Versions 0.14.0 to 26.0.0 via Unhandled Exception https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27448
Post summary
This entry announces a security bypass vulnerability in pyOpenSSL versions 0.14.0 through 26.0.0 caused by unhandled exceptions.
0000137
4.0K followersView on X
CVEarity@CVEarity204d
Disclosure
⚡ New CVE Alert: CVE-2026-27448 📊 Severity: 1.7 🚨 Risk Level: Low 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-27448 #CVE-2026-27448 #CVE #Low #CyberSecurity #InfoSec https://t.co/JQfdOfDMKJ
Post summary
The tweet is a simple announcement of a low‑severity CVE without technical details, exploitation evidence, or mitigation guidance.
0000033
104 followersView on X
CVE@CVEnew205d
General
CVE-2026-27448 pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servernam… https://www.cve.org/CVERecord?id=CVE-2026-27448
Post summary
The snippet references CVE-2026-27448 in pyOpenSSL, mentioning version constraints and a callback function, but provides no PoC, exploit details, active use, patch information, or technical specifics, leaving the context largely undefined.
00000125
56.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	pyopenssl	pyopenssl	-	-	-

Explore more

Back to dashboard pyopenssl CVEs pyopenssl vulnerabilities

What researchers are saying

CVE-2026-27448

Open Source Security mailing list@oss_securityPatch

The note announces that CVE-2026-27459 and CVE-2026-27448 have been fixed in pyOpenSSL 26.0.0, providing brief technical details of the issues.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

This entry announces a security bypass vulnerability in pyOpenSSL versions 0.14.0 through 26.0.0 caused by unhandled exceptions.

CVEarity@CVEarityDisclosure

The tweet is a simple announcement of a low‑severity CVE without technical details, exploitation evidence, or mitigation guidance.

CVE@CVEnewGeneral

The snippet references CVE-2026-27448 in pyOpenSSL, mentioning version constraints and a callback function, but provides no PoC, exploit details, active use, patch information, or technical specifics, leaving the context largely undefined.