Security Bypass Vulnerability in pyOpenSSL Library Affecting Multiple Versions

CVE-2026-27448

What is CVE-2026-27448?

The pyOpenSSL library, a Python wrapper around OpenSSL, contains a vulnerability that arises when users provide a callback to the 'set_tlsext_servername_callback' method which raises an unhandled exception. In versions prior to 26.0.0, this situation allowed connections to be accepted, potentially bypassing security measures that relied on this callback. This could enable unauthorized access to sensitive data or functions within applications using pyOpenSSL. In version 26.0.0 and later, the library has been updated to reject connections when an unhandled exception occurs, mitigating this risk.

References