CVE-2026-27459

Fixed in a distro release EPSS <1%CVSS 7.2

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.

Published 2026-03-17 · CVE record · OSV

Products: pyca pyopenssl, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Red Hat Satellite 6.18 for RHEL 9, Red Hat RHUI 4 for RHEL 8, Red Hat Ansible Automation Platform 2.5, Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7, Red Hat Hardened Images, Red Hat Quay 3.10, Red Hat Quay 3.12, Red Hat Quay 3.14, Red Hat Quay 3.15, Red Hat Quay 3.16, Red Hat Quay 3.17, Red Hat Quay 3.18, Red Hat Quay 3.9, Red Hat Trusted Artifact Signer 1.4, Red Hat Confidential Compute Attestation, Red Hat Exploit Intelligence, Red Hat Lightspeed Core, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers, Red Hat Update Infrastructure 5

Fixed upstream

Distro releases