Skip to content
OpenAdvisories
Low USN-8335-1 1 CVE

pyopenssl vulnerability

Published May 28, 2026 · Updated May 28, 2026

Ecosystem: Ubuntu

Summary

It was discovered that pyOpenSSL incorrectly handled exceptions in the
tlsext_servername callback. This could result in connections being accepted
after an exception, contrary to expectations.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS pyopenssl 0.15.1-2ubuntu0.2+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS pyopenssl 17.5.0-1ubuntu1+esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS pyopenssl 19.0.0-1ubuntu0.1~esm1

Vulnerabilities 1

  • Low 1.7
    CVE-2026-27448

    pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

    pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. …

    pyca pyopenssl airflow-3 py3-cassandra-medusa Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • report
    https://ubuntu.com/security/CVE-2026-27448