CVE-2026-27448
Medium
Description
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.
SeverityMedium
CVSS5.3
Exploit probability—
ProductPyopenssl
PublishedMar 18, 2026
First seenMar 18, 2026
Weakness typeCWE-636CWE-636
How to fix
Update
- pyopenssl pyopenssl26.0.0 or later
- pyopenssl26.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pyopenssl pyopenssl | 0.14 ≤ v < 26.0.0 | 26.0.0 |
| pyopensslPyPI | 0.14.0 ≤ v < 26.0.0, 0.14 ≤ v < 26.0.0 | 26.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.