pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

MEDIUM 5.3CVE-2026-27448 · GHSA-vp96-hxj8-p424 · PYSEC-2026-2268 · Published 18/03/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
pyopenssl PyPI	`≥ 0.14, < 26.0.0≥ 0.14.0, < 26.0.0`	`26.0.0`
pyopenssl pyopenssl	`≥ 0.14, < 26.0.0`	`26.0.0`

Description

If a user provided callback to set_tlsext_servername_callback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it.

Unhandled exceptions now result in rejecting the connection.

Credit to Leury Castillo for reporting this issue.

NVD description

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

References

pyca/pyopenssl security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-27448 · ADVISORY
pyca/pyopenssl commit d41a814 · WEB
pyca/pyopenssl · PACKAGE
pyca/pyopenssl · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free