Is CVE-2026-27459 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27459 being exploited in the wild.

How severe is CVE-2026-27459?

Critical severity, with a CVSS score of 9.8, published 18 March 2026.

Which products and versions are affected?

pyopenssl (PyPI) ECOSYSTEM:introduced=22.0.0,fixed=26.0.0.

Is there a fix for CVE-2026-27459?

Yes. pyopenssl (PyPI): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27459 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27459?

Check whether you run Pyopenssl or pyopenssl (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27459: pyOpenSSL buffer overflow in DTLS cookie generation callback

CVE-2026-27459 · Severity: critical · CVSS 9.8 · Published 2026-03-18

pyOpenSSL is a widely used Python library that provides secure communication capabilities for applications. A flaw in how it handles certain security callbacks could allow an attacker to cause a memory overflow, potentially leading to application crashes or unauthorized code execution. This affects services using DTLS (Datagram Transport Layer Security) that implement specific cookie generation routines.

Technologies: pyopenssl (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-27459 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27459 being exploited in the wild.
How severe is CVE-2026-27459?: Critical severity, with a CVSS score of 9.8, published 18 March 2026.
Which products and versions are affected?: pyopenssl (PyPI) ECOSYSTEM:introduced=22.0.0,fixed=26.0.0.
Is there a fix for CVE-2026-27459?: Yes. pyopenssl (PyPI): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27459 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27459?: Check whether you run Pyopenssl or pyopenssl (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyopenssl (PyPI): upgrade to 26.0.0 or later
```
pip install "pyopenssl>=26.0.0"
```

Technical details

A buffer overflow vulnerability (CWE-120) exists in pyOpenSSL versions 22.0.0 through 25.3.0. The issue occurs when a user-provided callback to `set_cookie_generate_callback` returns a cookie value greater than 256 bytes (DTLS1_COOKIE_LENGTH). pyOpenSSL fails to validate the length of this return value before copying it into a fixed-size native buffer provided by the underlying OpenSSL library. An attacker can exploit this to corrupt adjacent memory, potentially leading to remote code execution or a denial-of-service condition. The vulnerability is patched in version 26.0.0, which now rejects overly long cookie values.

Affected products

pyca pyOpenSSL >=22.0.0, <26.0.0

Identifiers

CVE-2026-27459
GHSA-5pwr-322w-8jr4
PYSEC-2026-2269

Timeline

2026-03-15: patched: Version 26.0.0 released with fix
2026-03-15: advisory: GitHub Security Advisory GHSA-5pwr-322w-8jr4 published
2026-03-18: disclosed: CVE-2026-27459 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.