CVE-2026-27459 is a critical (CVSS 9.8) buffer overflow in pyOpenSSL from 22.0.0 and before 26.0.0. If a callback given to set_cookie_generate_callback returns a cookie longer than 256 bytes, an OpenSSL buffer overflows. Upgrade to pyOpenSSL 26.0.0, which rejects long cookies.
What's affected
pyOpenSSL from 22.0.0 and prior to 26.0.0. The condition is narrow: the application must use set_cookie_generate_callback, and its callback must return a cookie longer than 256 bytes. From 26.0.0, too long cookie values are rejected.
How to check if you're exposed
pip show pyopenssl
pip list | grep -i pyopenssl
Then search your code for set_cookie_generate_callback. Few applications use it, since it relates to DTLS cookie exchange. If you do not call it, the vulnerable path is not reachable from your code, though you should still upgrade. Safeguard has a free in-browser dependency scan at https://gold.safeguard.sh/scan that checks a dependency file against known CVEs.
What to do now
- Upgrade pyOpenSSL to 26.0.0 or later.
- Search your code and your dependencies for set_cookie_generate_callback.
- If you use it, make sure the callback never returns more than 256 bytes.
- Rebuild container images and virtual environments that pin an older version.
- Check Linux distribution advisories if you use the system package, since vendors may backport the fix.
Why it matters
The weakness is CWE-120, a classic buffer copy without a size check. The callback's return value was copied into a fixed buffer owned by OpenSSL, so a long value wrote past its end. The fix adds a length check at the Python layer.
The score is high because the vector is network based, yet the real exposure depends on whether your code uses this one callback and where the cookie comes from. That is a good case for reachability analysis. The record does not mark this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does every pyOpenSSL user need to worry?
Upgrade anyway, but only code that sets a cookie generate callback that can return more than 256 bytes reaches the flaw.
Sources
- CVE-2026-27459 on Gold
- pyOpenSSL advisory listed in the record: https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4
- Fix commit listed in the record: https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408
Last reviewed: 19 October 2026.
