pyOpenSSL is a Python wrapper for OpenSSL. In versions >=22.0.0 and <26.0.0, the set_cookie_generate_callback function can trigger a buffer overflow if the callback returns a cookie string or byte sequence longer than 256 bytes. This occurs due to missing bounds checking before copying data into a fixed-size buffer provided by OpenSSL. The issue is exploitable only when an application uses a custom callback that returns an oversized cookie. Starting in version 26.0.0, pyOpenSSL enforces a limit on cookie length, rejecting values over 256 bytes to prevent overflow. The vulnerability is classified as CWE-120 (Classic Buffer Overflow) and can lead to memory modification, potential code execution, or denial of service.

The vulnerability can cause a buffer overflow in the OpenSSL buffer, potentially allowing an attacker to modify memory, execute unauthorized code or commands, or cause denial of service through crashes or resource exhaustion. However, exploitation requires a custom callback returning a cookie longer than 256 bytes, which limits the attack surface. There are no known exploits in the wild. The impact affects confidentiality, integrity, and availability.

A fix is available starting with pyOpenSSL version 26.0.0, which rejects cookie values longer than 256 bytes. Users should upgrade to version 26.0.0 or later. If upgrading is not immediately possible, ensure that any callback provided to set_cookie_generate_callback strictly limits cookie length to under 256 bytes to mitigate the vulnerability.