CVE-2026-27459

criticalpriority · track · 39EPSS 0.007 · 54 %ileDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.73% (54th) EPSS
CVSS 9.8 · critical
Is it mine?
53 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedpython311-pyOpenSSL-0:23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Module for Python 3 15 SP7suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:23.2.0-150400.3.13.1.noarch as component of openSUSE Leap 15.6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-pyOpenSSL-0:25.0.0-160000.3.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-pyOpenSSL-0:25.0.0-160000.3.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:24.0.0-slfo.1.1_2.1.noarch as component of SUSE Linux Micro 6.1suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:24.0.0-2.1.noarch as component of SUSE Linux Micro 6.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:26.0.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:26.0.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:26.0.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-pyOpenSSL-0:26.0.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-pyOpenSSL-0:26.0.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-pyOpenSSL-0:26.0.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-pyOpenSSL-0:26.0.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-pyOpenSSL-0:26.0.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-pyOpenSSL-0:25.0.0-160000.3.1.noarch as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.17highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:Hsecondary · SUSE Product Security
v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 2.2 · impact 5.9
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV
v4.07.2highCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:Usecondary · ENISA EU
v4.07.2highCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com
v4.07.2highCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-120USCWE-120USCWE-120US
05

affected products (53)

Products and version ranges known to be affected.

showing 20 of 53
06

advisories (10)

Vendor and ecosystem advisories describing this.

  • SUSE-SU-2026:1192-1Security update for python-pyOpenSSL2026-04-07csaf · suse_csafDE

    Security update for python-pyOpenSSL

  • SUSE-SU-2026:20930-1Security update for python-pyOpenSSL2026-03-25csaf · suse_csafDE

    Security update for python-pyOpenSSL

  • SUSE-SU-2026:20954-1Security update for python-pyOpenSSL2026-04-01csaf · suse_csafDE

    Security update for python-pyOpenSSL

  • SUSE-SU-2026:20960-1Security update for python-pyOpenSSL2026-04-01csaf · suse_csafDE

    Security update for python-pyOpenSSL

  • WID-SEC-W-2026-1183Red Hat Hardened Images RPMs (jq und pyOpenSSL): Mehrere SchwachstellenDeutsch2026-04-20csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Red Hat Hardened Images RPMs ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand verursachen, vertrauliche Informationen offenlegen oder nicht näher spezifizierte Angriffe durchführen, einschließlich potenzieller Codeausführung.

  • WID-SEC-W-2026-4111Red Hat Ansible Automation Platform: Mehrere SchwachstellenDeutsch2026-10-21csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Code mit Benutzer- oder Anwendungsrechten auszuführen, gültige kryptografische Token zu fälschen, die Authentifizierung zu umgehen, erweiterte Rechte zu erlangen, Denial-of-Service-Zustände auszulösen sowie Daten zu manipulieren oder offenzulegen.

  • openSUSE-SU-2026:10392-1python311-pyOpenSSL-26.0.0-1.1 on GA media2026-03-19csaf · suse_csafDE

    python311-pyOpenSSL-26.0.0-1.1 on GA media

  • openSUSE-SU-2026:20419-1Security update for python-pyOpenSSL2026-03-25csaf · suse_csafDE

    Security update for python-pyOpenSSL

  • GHSA-5pwr-322w-8jr4pyOpenSSL DTLS cookie callback buffer overflow2026-03-16ghsa · osvUS

    If a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Cookie values that are too long are now rejected.

  • PYSEC-2026-22692026-03-18vendor · osvUS

    pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.

07

also known as (7)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundsuse_csafNVDCVE.orgMITRE
published 2026-03-18modified 2026-09-10
09

references (35)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan