CVE-2026-27448

MEDIUM5.3EPSS 0.04%

pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

Published: 3/16/2026Modified: 5/11/2026

Description

If a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Unhandled exceptions now result in rejecting the connection. Credit to **Leury Castillo** for reporting this issue.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 4.0—CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
osvCVSS 3.1MEDIUM5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References (6)