CVE-2026-27448: pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
If a user provided callback to settlsextservernamecallback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it.
Unhandled exceptions now result in rejecting the connection.
Credit to Leury Castillo for reporting this issue.
Other sources
pyOpenSSL allows TLS connection bypass via unhandled callback exception in settlsextservernamecallback
— Microsoft
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to settlsextservernamecallback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27448?
CVE-2026-27448 has a medium severity level due to the potential for bypassing security-sensitive behaviors.
How do I fix CVE-2026-27448?
To fix CVE-2026-27448, update pyopenssl to version 26.0.0 or later.
What happens if the callback provided to set_tlsext_servername_callback raises an exception in CVE-2026-27448?
If the callback raises an unhandled exception, the connection will be accepted, potentially allowing security bypass.
Who is affected by CVE-2026-27448?
Users of pyopenssl versions between 0.14.0 and 26.0.0 are affected by CVE-2026-27448.
What is the impact of CVE-2026-27448 on applications using pyopenssl?
Applications relying on the set_tlsext_servername_callback for security-sensitive behavior may be at risk of connection acceptance despite exceptions.