Vulnerable Library - pyopenssl-25.1.0-py3-none-any.whl
Python wrapper module around the OpenSSL library
Library home page: https://files.pythonhosted.org/packages/80/28/2659c02301b9500751f8d42f9a6632e1508aa5120de5e43042b8b30f8d5d/pyopenssl-25.1.0-py3-none-any.whl
Found in HEAD commit: 39ac9ffe42e0bd2d34757b191521a19c3a058305
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-27459
Vulnerable Library - pyopenssl-25.1.0-py3-none-any.whl
Python wrapper module around the OpenSSL library
Library home page: https://files.pythonhosted.org/packages/80/28/2659c02301b9500751f8d42f9a6632e1508aa5120de5e43042b8b30f8d5d/pyopenssl-25.1.0-py3-none-any.whl
Dependency Hierarchy:
- ❌ pyopenssl-25.1.0-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 39ac9ffe42e0bd2d34757b191521a19c3a058305
Found in base branch: main
Vulnerability Details
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to "set_cookie_generate_callback" returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.
Publish Date: 2026-03-17
URL: CVE-2026-27459
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-16
Fix Resolution: https://github.com/pyca/pyopenssl.git - 26.0.0
Step up your Open Source Security Game with Mend here
CVE-2026-27448
Vulnerable Library - pyopenssl-25.1.0-py3-none-any.whl
Python wrapper module around the OpenSSL library
Library home page: https://files.pythonhosted.org/packages/80/28/2659c02301b9500751f8d42f9a6632e1508aa5120de5e43042b8b30f8d5d/pyopenssl-25.1.0-py3-none-any.whl
Dependency Hierarchy:
- ❌ pyopenssl-25.1.0-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 39ac9ffe42e0bd2d34757b191521a19c3a058305
Found in base branch: main
Vulnerability Details
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to "set_tlsext_servername_callback" raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.
Publish Date: 2026-03-17
URL: CVE-2026-27448
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-16
Fix Resolution: https://github.com/pyca/pyopenssl.git - 26.0.0
Step up your Open Source Security Game with Mend here
Python wrapper module around the OpenSSL library
Library home page: https://files.pythonhosted.org/packages/80/28/2659c02301b9500751f8d42f9a6632e1508aa5120de5e43042b8b30f8d5d/pyopenssl-25.1.0-py3-none-any.whl
Found in HEAD commit: 39ac9ffe42e0bd2d34757b191521a19c3a058305
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - pyopenssl-25.1.0-py3-none-any.whl
Python wrapper module around the OpenSSL library
Library home page: https://files.pythonhosted.org/packages/80/28/2659c02301b9500751f8d42f9a6632e1508aa5120de5e43042b8b30f8d5d/pyopenssl-25.1.0-py3-none-any.whl
Dependency Hierarchy:
Found in HEAD commit: 39ac9ffe42e0bd2d34757b191521a19c3a058305
Found in base branch: main
Vulnerability Details
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to "set_cookie_generate_callback" returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.
Publish Date: 2026-03-17
URL: CVE-2026-27459
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-03-16
Fix Resolution: https://github.com/pyca/pyopenssl.git - 26.0.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - pyopenssl-25.1.0-py3-none-any.whl
Python wrapper module around the OpenSSL library
Library home page: https://files.pythonhosted.org/packages/80/28/2659c02301b9500751f8d42f9a6632e1508aa5120de5e43042b8b30f8d5d/pyopenssl-25.1.0-py3-none-any.whl
Dependency Hierarchy:
Found in HEAD commit: 39ac9ffe42e0bd2d34757b191521a19c3a058305
Found in base branch: main
Vulnerability Details
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to "set_tlsext_servername_callback" raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.
Publish Date: 2026-03-17
URL: CVE-2026-27448
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-03-16
Fix Resolution: https://github.com/pyca/pyopenssl.git - 26.0.0
Step up your Open Source Security Game with Mend here