CVE-2026-27459

What it actually does

CVE-2026-27459 is a buffer overflow in pyOpenSSL versions 22.0.0 through versions before 26.0.0. When an application registers a user-supplied callback with set_cookie_generate_callback and that callback returns a cookie value larger than 256 bytes, pyOpenSSL can overflow an OpenSSL-provided buffer. In vulnerable applications that expose this code path, a remote unauthenticated attacker may be able to trigger memory corruption during cookie generation, potentially causing process crashes or, in the worst case, arbitrary code execution in the context of the affected Python process. Exploitation is highly dependent on application design because the vulnerable condition requires the application to use this callback and for the callback to return an oversized cookie.

Why it matters to the business

Systems using vulnerable pyOpenSSL versions in network-facing Python services may be exposed to service crashes or possible full compromise of the affected application process. The practical risk is highest for internet-facing services that use pyOpenSSL cookie-generation callbacks, particularly where attacker-controlled input can influence the cookie value. Although this is not currently listed in the CISA KEV catalog, has no known ransomware association, and has low EPSS at the time of assessment, the high CVSS rating means affected services should be upgraded promptly because successful exploitation could interrupt critical services or provide an attacker with a foothold inside an application runtime.

How an attack unfolds

An attacker first identifies a Python service that uses pyOpenSSL and exposes functionality relying on set_cookie_generate_callback, commonly in a network handshake or cookie-generation workflow. The attacker then sends crafted network traffic that causes the application’s registered callback to execute. If the application’s callback can be made to return more than 256 bytes, pyOpenSSL copies or passes that oversized value into an OpenSSL-provided fixed-size buffer, corrupting adjacent memory. Depending on platform protections, memory layout, and process privileges, this may result in a denial-of-service crash or potentially controlled memory corruption leading to code execution. Exploitation is not expected to be universal across all pyOpenSSL deployments; it requires the vulnerable API to be used and the oversized-cookie condition to be reachable.

How to fix it

Upgrade pyOpenSSL to version 26.0.0 or later, where oversized cookie values are rejected. If immediate upgrade is not possible, review application code for use of set_cookie_generate_callback and enforce a strict maximum returned cookie length of 256 bytes or less before returning data to pyOpenSSL. Remove or disable vulnerable callback usage where it is not required. Restrict network exposure for affected services, place them behind trusted ingress controls where feasible, and run affected Python services with least privilege to reduce blast radius. Rebuild and redeploy containers, virtual environments, and packaged applications that vendor or pin pyOpenSSL versions 22.0.0 through 25.x.

How to confirm the fix worked

Confirm the installed pyOpenSSL version is 26.0.0 or later in every runtime, container image, virtual environment, and application package. Use package inventory commands such as `python -m pip show pyOpenSSL`, `python -m pip freeze`, or software composition analysis tooling to identify vulnerable versions. Search source code and deployed artifacts for `set_cookie_generate_callback`; if present, verify the callback cannot return values larger than 256 bytes. Where safe and authorized, perform targeted testing against a non-production instance to confirm oversized callback return values are rejected rather than causing crashes. Monitor service stability after patching and verify no vulnerable pyOpenSSL versions remain in transitive or vendored dependencies.

Typical attack path

1. Fingerprint an exposed Python service or application stack that uses pyOpenSSL.
2. Determine whether the service exercises pyOpenSSL cookie-generation behavior through set_cookie_generate_callback or related DTLS/cookie-handling functionality.
3. Craft network input that triggers the registered cookie-generation callback.
4. Cause or influence the callback to return a cookie value longer than 256 bytes.
5. Trigger the vulnerable pyOpenSSL/OpenSSL buffer handling path.
6. Observe a crash, restart, abnormal TLS/DTLS behavior, or attempt to shape memory corruption for further exploitation.

How to detect it

To determine whether exploitation may have occurred, review logs and host artifacts for affected Python services that use pyOpenSSL, focusing on the period after public disclosure and any earlier suspicious instability. Useful sources include application logs, web or gateway logs, systemd/journald logs, container runtime logs, kernel crash logs, endpoint detection telemetry, core dump directories, and process supervisor restart histories. Look for unexplained Python process crashes, segmentation faults, core dumps, repeated service restarts, abnormal TLS/DTLS handshake failures, or network bursts that immediately precede crashes. In source and build telemetry, search for `set_cookie_generate_callback` to identify services with the reachable vulnerable pattern. If core dumps are available, analyze them for crashes in pyOpenSSL, OpenSSL SSL cookie-generation routines, or Python extension bindings around SSL callback execution. There are no broadly reliable network IOCs for this vulnerability because exploit traffic depends on application-specific callback behavior and protocol exposure.

• set_cookie_generate_callback
• cookie_generate_callback
• OpenSSL.SSL
• pyOpenSSL
• segmentation fault
• Segmentation fault
• core dumped
• Fatal Python error
• SIGSEGV
• systemd-coredump
• Process crashed with signal 11
• OpenSSL.SSL.Error

What your security team should do

• Prioritize upgrading all pyOpenSSL installations from versions 22.0.0 through 25.x to 26.0.0 or later, especially in internet-facing services.
• Inventory Python applications, containers, and virtual environments for pyOpenSSL usage and version pins.
• Search application code for `set_cookie_generate_callback` and review any callback logic for oversized return values or attacker-influenced cookie generation.
• Apply compensating controls, including network access restrictions and least-privilege service accounts, until upgrades are complete.
• Add monitoring for abnormal Python process crashes, segmentation faults, core dumps, and repeated handshake failures on services using pyOpenSSL.
• Rebuild base images and redeploy applications to ensure patched dependencies are actually running in production.
• Track upstream advisories for pyOpenSSL and OpenSSL in case additional exploitation details or proof-of-concept code become available.