CVE-2026-27448
Fixed in a distro release EPSS <1%CVSS 1.7
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.
Products: pyca pyopenssl
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pyopenssl | 26.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | 2.11.2-r2 |
| Chainguard | airflow-3 | 3.1.8-r8 |
| Chainguard | authentik | 2026.2.1-r4 |
| Chainguard | authentik-fips | 2026.2.1-r3 |
| Chainguard | awx | 24.6.1-r31 |
| Chainguard | az | 2.84.0-r3 |
| Chainguard | datadog-agent-7.71-core-integrations | no fix |
| Chainguard | datadog-agent-7.72-core-integrations | no fix |
| Chainguard | datadog-agent-7.73-core-integrations | 7.73.3-r23 |
| Chainguard | datadog-agent-7.74-core-integrations | 7.74.1-r24 |
| Chainguard | datadog-agent-7.75-core-integrations | no fix |
| Chainguard | datadog-agent-7.76 | 7.76.3-r41 |
| Chainguard | datadog-agent-7.76-core-integrations | 7.76.3-r32 |
| Chainguard | datadog-agent-7.77-core-integrations | 7.77.3-r5 |
| Chainguard | datadog-agent-fips-7.71-core-integrations | 7.71.2-r19 |
| Chainguard | datadog-agent-fips-7.71-core-integrations | 7.71.2-r20 |
| Chainguard | datadog-agent-fips-7.72-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.73-core-integrations | 7.73.3-r26 |
| Chainguard | datadog-agent-fips-7.74-core-integrations | 7.74.1-r26 |
| Chainguard | datadog-agent-fips-7.75-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.76-core-integrations | 7.76.3-r32 |
| Chainguard | datadog-agent-fips-7.77-core-integrations | 7.77.3-r5 |
| Chainguard | datahub-ingestion | 1.5.0.1-r0 |
| Chainguard | dbt-snowflake | 1.12.1-r0 |
| Chainguard | ggshield | 1.51.0-r1 |
| Chainguard | gitlab-toolbox-ce-18.7 | 18.7.5-r1 |
| Chainguard | gitlab-toolbox-ce-18.8 | 18.8.5-r2 |
| Chainguard | gitlab-toolbox-ce-18.9 | 18.9.2-r1 |
| Chainguard | gitlab-toolbox-ce-fips-18.7 | 18.7.5-r1 |
| Chainguard | gitlab-toolbox-ce-fips-18.8 | 18.8.5-r1 |
| Chainguard | gitlab-toolbox-ce-fips-18.9 | 18.9.2-r1 |
| Chainguard | gitlab-toolbox-ce-fips-19.0 | 19.0.2-r1 |
| Chainguard | keep-api | 0.51.0-r0 |
| Chainguard | keep-api-fips | 0.51.0-r0 |
| Chainguard | localstack | 4.14.0-r4 |
| Chainguard | mitmproxy | 12.2.1-r0 |
| Chainguard | mitmproxy | 12.2.3-r0 |
| Chainguard | py3-cassandra-medusa | 0.27.0-r5 |
| Chainguard | py3.13-duplicity | no fix |
| Chainguard | request-1276 | 0.27.0-r6 |
| Chainguard | superset-5.0 | 5.0.0-r20 |
| Chainguard | superset-6.0 | 6.0.0-r4 |
| Debian 12 | pyopenssl | no fix |
| Debian 13 | pyopenssl | 25.0.0-1+deb13u1 |
| Debian 14 | pyopenssl | 26.0.0-1 |
| Red Hat hummingbird 1 | pyOpenSSL | 0:26.0.0-1.1.hum1 |
| Red Hat hummingbird 1 | pyOpenSSL-doc | 0:26.0.0-1.1.hum1 |
| Red Hat hummingbird 1 | python3-pyOpenSSL | 0:26.0.0-1.1.hum1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise Micro 5.2 | python-pyOpenSSL | 19.0.0-150300.3.3.1 |
| SUSE Linux Enterprise Micro 5.3 | python3-pyOpenSSL | 21.0.0-150400.22.1 |
| SUSE Linux Enterprise Micro 5.4 | python3-pyOpenSSL | 21.0.0-150400.22.1 |
| SUSE Linux Enterprise Micro 5.5 | python3-pyOpenSSL | 21.0.0-150400.22.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | python3-pyOpenSSL | 21.0.0-150400.22.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise Server 16.0 | python-pyOpenSSL | 25.0.0-160000.3.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | python-pyOpenSSL | 17.1.0-4.32.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-pyOpenSSL | 25.0.0-160000.3.1 |
| SUSE Linux Micro 6.0 | python-pyOpenSSL | 24.0.0-2.1 |
| SUSE Linux Micro 6.1 | python-pyOpenSSL | 24.0.0-slfo.1.1_2.1 |
| SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | venv-salt-minion | 3006.0-1.76.1 |
| SUSE Multi Linux Manager Tools SLE-15 | venv-salt-minion | 3006.0-150002.5.19.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | venv-salt-minion | 3006.0-150002.5.19.1 |
| Ubuntu 22.04 LTS | pyopenssl | 21.0.0-1ubuntu0.1 |
| Ubuntu 24.04 LTS | pyopenssl | 23.2.0-1ubuntu0.1 |
| Ubuntu 25.10 | pyopenssl | 25.0.0-1ubuntu0.1 |
| Ubuntu Pro 16.04 LTS | pyopenssl | 0.15.1-2ubuntu0.2+esm1 |
| Ubuntu Pro 18.04 LTS | pyopenssl | 17.5.0-1ubuntu1+esm1 |
| Ubuntu Pro 20.04 LTS | pyopenssl | 19.0.0-1ubuntu0.1~esm1 |
| Wolfi | airflow-3 | 3.1.8-r8 |
| Wolfi | az | 2.84.0-r3 |
| Wolfi | datadog-agent-7.72-core-integrations | no fix |
| Wolfi | datadog-agent-7.73-core-integrations | 7.73.3-r23 |
| Wolfi | datadog-agent-7.74-core-integrations | 7.74.1-r24 |
| Wolfi | datadog-agent-7.75-core-integrations | no fix |
| Wolfi | datadog-agent-7.76 | 7.76.3-r41 |
| Wolfi | datadog-agent-7.76-core-integrations | 7.76.3-r32 |
| Wolfi | datadog-agent-7.77-core-integrations | 7.77.3-r5 |
| Wolfi | ggshield | 1.51.0-r1 |
| Wolfi | mitmproxy | 12.2.1-r0 |
| Wolfi | mitmproxy | 12.2.3-r0 |
| Wolfi | py3-cassandra-medusa | 0.27.0-r5 |
| Wolfi | superset-6.0 | 6.0.0-r4 |
| openSUSE Leap 15.6 | python-pyOpenSSL | 23.2.0-150400.3.13.1 |
| openSUSE Leap 16.0 | python-pyOpenSSL | 25.0.0-160000.3.1 |
| openSUSE Tumbleweed | python-pyOpenSSL | 26.0.0-1.1 |