Bug 2448503 (CVE-2026-27459)

Summary: CVE-2026-27459 pyOpenSSL: DTLS cookie callback buffer overflow
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: adudiak, anthomas, aprice, bdettelb, caswilli, doconnor, dranck, dschmidt, eglynn, ehelms, erezende, ggainey, jdobes, jjoyce, jkoehler, jlanda, jmitchel, jsamir, jschluet, juwatts, jwong, kaycoth, kshier, lball, lbrazdil, lhh, lphiri, mburns, mgarciac, mhulan, mminar, ngough, nmoumoul, oezr, omaciel, orabin, osousa, pbohmill, pcreech, rbiba, rchan, simaishi, smallamp, smcdonal, sskracic, stcannon, teagle, tmalecek, tpfromme, ttakamiy, veshanka, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2448652, 2448655    
Bug Blocks:    

Description OSIDB Bzimport 2026-03-18 00:02:08 UTC 
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.