CVE-2026-27448

Katalog CVE

CVSS 5.3 · Medium EPSS 0,39%

Kerentanan Not Failing Securely ('Failing Open') pada pyopenssl. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-636: Not Failing Securely ('Failing Open')

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pyca/pyopenssl/security/advisories/GHSA-vp96-hxj8-p424 advisory vendor
• https://github.com/pyca/pyopenssl/commit/d41a814759a9fb49584ca8ab3f7295de49a85aa0 patch
• https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst#L27 release notes