Threats affecting pkg:pypi/pyopenssl

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.

CVE-2026-27448 is a vulnerability in pyOpenSSL versions from 0.14.0 up to but not including 26.0.0. It involves unhandled exceptions in user-provided callbacks to set_tlsext_servername_callback, which cause the connection to be accepted rather than rejected. This behavior is a failure to fail securely ('failing open'), potentially allowing bypass of security-sensitive logic in these callbacks. The issue was fixed in pyOpenSSL version 26.0.0 by changing the behavior to reject connections on such exceptions.