CVE-2026-27459 is a buffer overflow vulnerability in the pyOpenSSL library affecting the set_cookie_generate_callback function used to generate DTLS cookies. If the custom callback returns a cookie longer than 256 bytes, a buffer overflow occurs due to missing bounds checking before copying data into a fixed-size buffer in OpenSSL. This can lead to memory corruption, potential unauthorized code execution, or denial of service. The vulnerability requires a custom callback returning an excessively long cookie, limiting exposure. Red Hat's advisory rates the severity as important and recommends ensuring the callback limits cookie length to under 256 bytes. The issue is tracked under multiple CWEs including CWE-120 (classic buffer overflow).

Successful exploitation can result in memory modification, unauthorized code execution, or denial of service conditions such as crashes or resource exhaustion. However, exploitation requires a custom callback returning a cookie string or byte sequence longer than 256 bytes, which limits the vulnerability's exposure. There are no known exploits in the wild at this time.

Red Hat advises ensuring that any callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to less than 256 bytes. This mitigation effectively prevents the buffer overflow. No official patch status is explicitly stated in the advisory; therefore, patch status is not yet confirmed—check the vendor advisory for current remediation guidance.