7.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27459

CVE-2026-27459: pyOpenSSL DTLS cookie callback buffer overflow

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to set_cookie_generate_callback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27459

CVE-2026-27459:

7.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pyopenssl	pip	>= 22.0.0, < 26.0.0	26.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a buffer overflow within the pyOpenSSL library's DTLS cookie generation mechanism. The analysis of the patch commit 57f09bb4bb051d3bc2a1abd36e9525313d5cd408 reveals the root cause. The library allows a user to define a callback function for generating DTLS cookies via Context.set_cookie_generate_callback. This user function is invoked by an internal wrapper function inside the _CookieGenerateCallbackHelper class during a DTLS handshake. The vulnerability lies in this wrapper function, which, prior to the patch, would copy the bytes of the user-generated cookie into a fixed-size buffer allocated by OpenSSL without validating the cookie's length. The patch introduces a check to ensure the cookie's length does not exceed the maximum allowed size (DTLS1_COOKIE_LENGTH), thus preventing the overflow. Therefore, the _CookieGenerateCallbackHelper.wrapper function is identified as the vulnerable function, as it contains the code that performs the unsafe memory copy.

Vulnerable functions

_CookieGenerateCallbackHelper.wrapper

src/OpenSSL/SSL.py

The `wrapper` function within the `_CookieGenerateCallbackHelper` class is used as a callback for DTLS cookie generation. It takes the cookie bytes returned from the user-provided callback and copies them into a fixed-size buffer (`out`) provided by the underlying OpenSSL library. The vulnerability existed because this function did not check the length of the cookie before the copy operation. If the user's callback returned a cookie larger than the buffer's size (256 bytes), a buffer overflow would occur, leading to memory corruption.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.