Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-27459

pyOpenSSL DTLS cookie callback buffer overflow

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Pyca Pyopenssl
Products
Pyopenssl Pyopenssl
CVE-2026-27448

pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed
Vendors
Pyca Pyopenssl
Products
Pyopenssl Pyopenssl
CVE-2018-1000807

pyOpenSSL: Use-after-free in X509 object handling

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

CVSS 3.1 · 8.1 High EPSS 4.1% KEV · Not listed
Vendors
Canonical Pyopenssl Redhat
Products
Ubuntu Linux Pyopenssl Enterprise Linux Desktop and 3 more