PyPI/pyopenssl CVE-2026-27448: medium 5.3, EPSS 0.26%

pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

Action: Upgrade pyopenssl to 26.0.0 or later.

pip install pyopenssl==26.0.0

Affected

Fixed versions

Sources

• osv: GHSA-vp96-hxj8-p424
• nvd: CVE-2026-27448
• https://github.com/pyca/pyopenssl/security/advisories/GHSA-vp96-hxj8-p424
• https://github.com/pyca/pyopenssl/commit/d41a814759a9fb49584ca8ab3f7295de49a85aa0
• https://github.com/pyca/pyopenssl
• https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst#L27

CVE-2026-27448 · published 2026-03-16T15:15:43Z · modified 2026-09-10T03:51:00.753013360Z · JSON