pyOpenSSL 0.14.0-<26.0.0 TLS ServerName CB Exception Bypass
CVE-2026-27448 Published on March 17, 2026

pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

NVD

Weakness Type

What is a Failing Open Vulnerability?

When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions. By entering a less secure state, the product inherits the weaknesses associated with that state, making it easier to compromise. At the least, it causes administrators to have a false sense of security. This weakness typically occurs as a result of wanting to "fail functional" to minimize administration and support costs, instead of "failing safe."

CVE-2026-27448 has been classified to as a Failing Open vulnerability or weakness.


Affected Versions

pyca pyopenssl Version >= 0.14.0, < 26.0.0 is affected by CVE-2026-27448

Exploit Probability

EPSS
0.04%
Percentile
11.80%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.