Skip to content

Buffer overflow if DTLS cookie callback returned too long of a value

Moderate
alex published GHSA-5pwr-322w-8jr4 Mar 15, 2026

Package

pip pyopenssl (pip)

Affected versions

>=22.0.0

Patched versions

>=26.0.0

Description

If a user provided callback to set_cookie_generate_callback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer.

Cookie values that are too long are now rejected.

Severity

Moderate

CVE ID

CVE-2026-27459

Weaknesses

No CWEs

Credits