{"action":"Upgrade pyopenssl to 26.0.0 or later.","affected":[{"fixed":"26.0.0","introduced":"0.14"}],"component":"pyopenssl","cve_ids":["CVE-2026-27448"],"ecosystem":"PyPI","epss":0.00251,"exploited":false,"fixed_versions":["26.0.0"],"ghsa_id":"GHSA-vp96-hxj8-p424","id":"tcs_01M5KGYEP0GSF5NHW6CHKK72Y3","modified_at":"2026-07-13T07:15:42.074177418Z","published_at":"2026-03-18T00:16:19.107Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2268","https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst#L27","https://github.com/pyca/pyopenssl/security/advisories/GHSA-vp96-hxj8-p424","https://github.com/pyca/pyopenssl/commit/d41a814759a9fb49584ca8ab3f7295de49a85aa0"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-2268","url":"https://osv.dev/vulnerability/PYSEC-2026-2268"}],"summary":"pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled ex"}