CVE-2026-27459 is a security vulnerability in the pyOpenSSL component used by Red Hat Update Infrastructure 4, involving a DTLS cookie callback buffer overflow (CWE-120). This vulnerability can be exploited remotely without privileges or user interaction but requires high attack complexity. The flaw impacts confidentiality, integrity, and availability. Red Hat has released an important security update in RHUI 4.11.4 that resolves this issue by updating the pyOpenSSL package. The fix requires applying the update, rerunning the rhui-installer on the RHUI node, and reinstalling CDS nodes as per Red Hat's documentation.

The vulnerability allows remote attackers to potentially cause a buffer overflow in the DTLS cookie callback function within pyOpenSSL, which could lead to compromise of confidentiality, integrity, and availability of the affected system. The CVSS vector indicates no privileges or user interaction are required, but the attack complexity is high. This could result in significant security impact if exploited.

A security update is available in Red Hat Update Infrastructure version 4.11.4 that addresses this vulnerability by updating the pyOpenSSL package. Users should apply this update and ensure all previously released errata are applied. Additionally, it is necessary to rerun the rhui-installer on the RHUI node and reinstall the CDS nodes as described in the Red Hat Update Infrastructure documentation for the fix to take effect. Refer to Red Hat advisory RHSA-2026:10754 and official documentation for detailed upgrade instructions.