CVE-2026-27448

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to set_tlsext_servername_callback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to set_tlsext_servername_callback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

If a user provided callback to set_tlsext_servername_callback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it.

Unhandled exceptions now result in rejecting the connection.

Credit to Leury Castillo for reporting this issue.

pyOpenSSL is a rather thin wrapper around (a subset of) the OpenSSL library. With thin wrapper we mean that a lot of the object methods do nothing more than calling a corresponding function in the OpenSSL library.

Security Fix(es):

A security vulnerability exists in the PyOpenSSL library's set_tlsext_servername_callback function. When a user-provided callback function raises an unhandled exception, the connection would still be accepted. If a user relies on this callback for any security-sensitive behavior (such as server name-based access control or certificate validation), this vulnerability could allow the security mechanism to be bypassed, potentially permitting unauthorized connections or access.(CVE-2026-27448)

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to set_cookie_generate_callback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.(CVE-2026-27459)

pyOpenSSL is a rather thin wrapper around (a subset of) the OpenSSL library. With thin wrapper we mean that a lot of the object methods do nothing more than calling a corresponding function in the OpenSSL library.

Security Fix(es):

A security vulnerability exists in the PyOpenSSL library's set_tlsext_servername_callback function. When a user-provided callback function raises an unhandled exception, the connection would still be accepted. If a user relies on this callback for any security-sensitive behavior (such as server name-based access control or certificate validation), this vulnerability could allow the security mechanism to be bypassed, potentially permitting unauthorized connections or access.(CVE-2026-27448)

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to set_cookie_generate_callback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.(CVE-2026-27459)

pyOpenSSL is a rather thin wrapper around (a subset of) the OpenSSL library. With thin wrapper we mean that a lot of the object methods do nothing more than calling a corresponding function in the OpenSSL library.

Security Fix(es):

A security vulnerability exists in the PyOpenSSL library's set_tlsext_servername_callback function. When a user-provided callback function raises an unhandled exception, the connection would still be accepted. If a user relies on this callback for any security-sensitive behavior (such as server name-based access control or certificate validation), this vulnerability could allow the security mechanism to be bypassed, potentially permitting unauthorized connections or access.(CVE-2026-27448)

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to set_cookie_generate_callback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.(CVE-2026-27459)

pyOpenSSL is a rather thin wrapper around (a subset of) the OpenSSL library. With thin wrapper we mean that a lot of the object methods do nothing more than calling a corresponding function in the OpenSSL library.

Security Fix(es):

A security vulnerability exists in the PyOpenSSL library's set_tlsext_servername_callback function. When a user-provided callback function raises an unhandled exception, the connection would still be accepted. If a user relies on this callback for any security-sensitive behavior (such as server name-based access control or certificate validation), this vulnerability could allow the security mechanism to be bypassed, potentially permitting unauthorized connections or access.(CVE-2026-27448)

pyOpenSSL is a rather thin wrapper around (a subset of) the OpenSSL library. With thin wrapper we mean that a lot of the object methods do nothing more than calling a corresponding function in the OpenSSL library.

Security Fix(es):

A security vulnerability exists in the PyOpenSSL library's set_tlsext_servername_callback function. When a user-provided callback function raises an unhandled exception, the connection would still be accepted. If a user relies on this callback for any security-sensitive behavior (such as server name-based access control or certificate validation), this vulnerability could allow the security mechanism to be bypassed, potentially permitting unauthorized connections or access.(CVE-2026-27448)

pyOpenSSL is a rather thin wrapper around (a subset of) the OpenSSL library. With thin wrapper we mean that a lot of the object methods do nothing more than calling a corresponding function in the OpenSSL library.

Security Fix(es):

A security vulnerability exists in the PyOpenSSL library's set_tlsext_servername_callback function. When a user-provided callback function raises an unhandled exception, the connection would still be accepted. If a user relies on this callback for any security-sensitive behavior (such as server name-based access control or certificate validation), this vulnerability could allow the security mechanism to be bypassed, potentially permitting unauthorized connections or access.(CVE-2026-27448)

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to set_cookie_generate_callback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.(CVE-2026-27459)

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to set_tlsext_servername_callback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

Root has patched CVE-2026-27448 in the rootio-pyOpenSSL package for Root:PyPI. Multiple fixed versions available.

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to set_tlsext_servername_callback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to set_tlsext_servername_callback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

TuxCare rebuilt pyopenssl to address 2 CVEs. Fixed in 23.3.0.post1+tuxcare.

TuxCare rebuilt pyopenssl to address 2 CVEs. Fixed in 24.3.0.post1+tuxcare.

TuxCare rebuilt pyopenssl to address 2 CVEs. Fixed in 25.3.0.post1+tuxcare.

• CVE-2026-27448: fix fail-open in set_tlsext_servername_callback when callback raises exception

• CVE-2026-27448: fix fail-open in set_tlsext_servername_callback when callback raises exception

pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback. (CVE-2026-27448) pyOpenSSL DTLS cookie callback buffer overflow. (CVE-2026-27459)

These are all security issues fixed in the python311-pyOpenSSL-26.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-pyOpenSSL fixes the following issues:

• CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
• CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service (bsc#1259554)
  • CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)
  • CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)

• Other updates and bugfixes:

  • Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
  • Hardened Tornado from invalid HTTP reason phrases
  • Read full URI from ldap pillar config (bsc#1254900)
  • Make users with backslash work for salt-ssh (bsc#1254629).
  • Fixed ansible.playbooks extra-vars quoting (bsc#1257831),
  • Fixed virtualenv call in test helper to use proper Python version.
  • Fixed the issue preventing SELinux profile to be loaded on SLES 16 deployed using cloud images (bsc#1258957)

This update fixes the following issues:

venv-salt-minion:

• CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808)

• CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804)

• Improved shutdown reliability when the salt-master/minion is terminated

• Fixed broken 'pkg.info_installed' after migration to salt.utils.timeutil

• Calculate UUID grain for Xen PV guests (bsc#1255418)

• Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)

• BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases

• Read full URI from ldap pillar config (bsc#1254900)

This update for python-pyOpenSSL fixes the following issues:

• CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
• CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).

This update for python-pyOpenSSL fixes the following issue:

• CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).

This update for python-pyOpenSSL fixes the following issue:

• CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).

This update for python-pyOpenSSL fixes the following issues:

• CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
• CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).

This update for python-pyOpenSSL fixes the following issues:

• CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
• CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).

This update for python-pyOpenSSL fixes the following issues:

• CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
• CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).

This update fixes the following issues:

golang-github-prometheus-node_exporter:

• Version 1.10.2:

  • meminfo: Fix typo in Zswap metric name

• Version 1.10.1:

  • filesystem: Fix mount points being collected multiple times
  • filesystem: Refactor mountinfo parsing (bsc#1261810)
  • meminfo: Add Zswap/Zswapped metrics

• Version 1.10.0:

  • Changes:

    • mdadm: Use sysfs for RAID metrics
    • filesystem: Add erofs in default excluded fs
    • tcpstat: Use std lib binary.NativeEndian

  • New Features:

    • pcidevice: Add new collector for PCIe devices
    • AIX: Add more metrics
    • systemd: Add Virtualization metrics
    • swaps: Add new collector

  • Enhancements:

    • wifi: Add packet received and transmitted metrics
    • filesystem: Take super options into account for read-only
    • pcidevice: Add additional metrics
    • perf: Add tlb_data metrics

  • Bugs fixed:

    • interrupts: Fix OpenBSD interrupt device parsing
    • diskstats: Simplify condition
    • thermal: Sanitize darwin thermal strings
    • filesystem: Fix Darwin collector cgo memory leak
    • cpufreq: Fix: collector enable
    • ethtool: Fix returning 0 for sanitized metrics
    • netdev: Fix Darwin netdev i/o bytes metric
    • systemd: Fix logging race
    • filesystem: Fix duplicate Darwin CGO import

salt:

• Security issues fixed:

  • CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service (bsc#1259554)

• Other updates and bugfixes:

  • Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
  • Hardened Tornado from invalid HTTP reason phrases
  • Read full URI from ldap pillar config (bsc#1254900)
  • Fixed testsuite failures
  • Make users with backslash working for salt-ssh (bsc#1254629)
  • Fixed ansible.playbooks extra-vars quoting (bsc#1257831)
  • Fixed virtualenv call in test helper to use proper python version

uyuni-tools:

• Version 0.1.39-0:

  • mgrpxy ssh tuning should happen before crypto policies (bsc#1254619)
  • Fixed default value for helm registry (bsc#1258927).
  • Use static supportconfig name to avoid dynamic search (bsc#1257941)
  • Do not nest multiple tarball files and instead collect all files into one tarball (bsc#1252964)
  • Show where final tarball was generated (bsc#1259208)

venv-salt-minion:

• Security issues fixed:

  • CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service (bsc#1259554)
  • CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)
  • CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)

• Other updates and bugfixes:

  • Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
  • Hardened Tornado from invalid HTTP reason phrases
  • Read full URI from ldap pillar config (bsc#1254900)
  • Make users with backslash work for salt-ssh (bsc#1254629).
  • Fixed ansible.playbooks extra-vars quoting (bsc#1257831),
  • Fixed virtualenv call in test helper to use proper Python version.
  • Fixed the issue preventing SELinux profile to be loaded on SLES 16 deployed using cloud images (bsc#1258957)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service (bsc#1259554)
  • CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)
  • CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)

• Other updates and bugfixes:

  • Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
  • Hardened Tornado from invalid HTTP reason phrases
  • Read full URI from ldap pillar config (bsc#1254900)
  • Make users with backslash work for salt-ssh (bsc#1254629).
  • Fixed ansible.playbooks extra-vars quoting (bsc#1257831),
  • Fixed virtualenv call in test helper to use proper Python version.
  • Fixed the issue preventing SELinux profile to be loaded on SLES 16 deployed using cloud images (bsc#1258957)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service (bsc#1259554)
  • CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)
  • CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)

• Other updates and bugfixes:

  • Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
  • Hardened Tornado from invalid HTTP reason phrases
  • Read full URI from ldap pillar config (bsc#1254900)
  • Make users with backslash work for salt-ssh (bsc#1254629).
  • Fixed ansible.playbooks extra-vars quoting (bsc#1257831),
  • Fixed virtualenv call in test helper to use proper Python version.
  • Fixed the issue preventing SELinux profile to be loaded on SLES 16 deployed using cloud images (bsc#1258957)

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service (bsc#1259554)
  • CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)
  • CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)

• Other updates and bugfixes:

  • Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
  • Hardened Tornado from invalid HTTP reason phrases
  • Read full URI from ldap pillar config (bsc#1254900)
  • Make users with backslash work for salt-ssh (bsc#1254629).
  • Fixed ansible.playbooks extra-vars quoting (bsc#1257831),
  • Fixed virtualenv call in test helper to use proper Python version.
  • Fixed the issue preventing SELinux profile to be loaded on SLES 16 deployed using cloud images (bsc#1258957)

This update for python3-pyOpenSSL fixes the following issue:

• CVE-2026-27448: unhandled exception in set_tlsext_servername_callback callback can result in connection not being cancelled and allows for possible security measure bypassing (bsc#1259804).

It was discovered that pyOpenSSL incorrectly handled exceptions in the tlsext_servername callback. This could result in connections being accepted after an exception, contrary to expectations. (CVE-2026-27448)

It was discovered that pyOpenSSL incorrectly handled the DTLS cookie generation callback. If a callback provided cookie values greater than 256 bytes, an attacker could use this issue to cause pyOpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-27459)

It was discovered that pyOpenSSL incorrectly handled exceptions in the tlsext_servername callback. This could result in connections being accepted after an exception, contrary to expectations.