This vulnerability in pyOpenSSL affects versions from 0.14.0 up to but not including 26.0.0. When user-provided callbacks to set_tlsext_servername_callback raise unhandled exceptions, the connection is incorrectly accepted instead of being rejected. This 'failing open' behavior can allow attackers to bypass security checks implemented in these callbacks. The issue is classified under CWE-636 (Not Failing Securely). The problem was addressed in version 26.0.0 by modifying the code to reject connections when such exceptions occur, thereby enforcing secure failure behavior.

The vulnerability allows connections to be accepted despite exceptions in security-sensitive callbacks, potentially bypassing logic intended to validate or restrict connections. However, the impact is limited by the low CVSS score of 1.7, indicating low severity and limited exploitability. There are no known exploits in the wild at this time.

Upgrade pyOpenSSL to version 26.0.0 or later, where this vulnerability is fixed by rejecting connections on exceptions in set_tlsext_servername_callback. No other mitigation is indicated or required.