CVE-2026-27459 is a buffer overflow vulnerability in the pyOpenSSL library's set_cookie_generate_callback function. When a custom callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can occur due to missing bounds checking before copying data into a fixed-size buffer in the underlying OpenSSL library. This vulnerability requires that the application using pyOpenSSL provides such a custom callback and returns an oversized cookie, limiting its exposure. The flaw is associated with CWE-120 (Classic Buffer Overflow) and can lead to memory modification, unauthorized code execution, or denial of service. Red Hat Hardened Images RPMs are affected, and the advisory references multiple CVEs including CVE-2026-27448 and CVE-2026-27459. No explicit patch availability is stated in the vendor advisory, but mitigation guidance is provided.

The vulnerability can lead to memory corruption, potentially allowing unauthorized code execution or denial of service conditions such as crashes or resource exhaustion. However, exploitation is constrained by the requirement that a custom callback returns a cookie longer than 256 bytes, which limits the attack surface. Red Hat rates this as an important severity issue, with high impact on confidentiality, integrity, and availability if exploited.

Red Hat advises mitigating this vulnerability by ensuring that any custom callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes. No official patch or update is explicitly confirmed in the advisory; therefore, users should follow the mitigation guidance and monitor Red Hat advisories for any forthcoming fixes.