# CVE-2026-27448: pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback CVE-2026-27448 is fixed in 7 products on 1 platform, first by python-openssl 17.5.0-1ubuntu1+esm1, released March 17, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-27448 - Priority: Routine - CVSS: 5.4 (Low) - EPSS: 0.0026 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 17, 2026 - Weakness: Not Failing Securely ('Failing Open') - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27448 ## Description pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | pyopenssl Debian 13.5 (trixie) | 25.0.0-1+deb13u1 | [DEBIAN-CVE-2026-27448](https://patchblox.com/security/data/fix/linux/debian-cve-2026-27448.md) | Mar 18, 2026 | | Linux | pyopenssl Debian 14 | 26.0.0-1 | [DEBIAN-CVE-2026-27448](https://patchblox.com/security/data/fix/linux/debian-cve-2026-27448.md) | Mar 18, 2026 | | Linux | python-openssl Ubuntu 18.04.6 LTS (bionic) | 17.5.0-1ubuntu1+esm1 | [python-openssl 17.5.0-1ubuntu1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-openssl-17.5.0-1ubuntu1-esm1.md) | Mar 17, 2026 | | Linux | python-openssl Ubuntu 20.04 LTS (focal) | 19.0.0-1ubuntu0.1~esm1 | [python-openssl 19.0.0-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python-openssl-19.0.0-1ubuntu0.1-esm1.md) | Mar 17, 2026 | | Linux | python-pyOpenSSL opensuse-leap 15.6 | 23.2.0-150400.3.13.1 | [SUSE-SU-2026:1192-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1192-1.md) | Apr 7, 2026 | | Linux | python-pyOpenSSL opensuse-leap 16.0 | 25.0.0-160000.3.1 | [OPENSUSE-SU-2026:20419-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20419-1.md) | Mar 25, 2026 | | Linux | python-pyOpenSSL sles 15.6 | 23.2.0-150400.3.13.1 | [SUSE-SU-2026:1192-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1192-1.md) | Apr 7, 2026 | | Linux | python-pyOpenSSL sles 15.7 | 23.2.0-150400.3.13.1 | [SUSE-SU-2026:1192-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1192-1.md) | Apr 7, 2026 | | Linux | python-pyOpenSSL sles 16.0 | 25.0.0-160000.3.1 | [SUSE-SU-2026:20930-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20930-1.md) | Mar 25, 2026 | | Linux | python3-openssl Ubuntu 18.04.6 LTS (bionic) | 17.5.0-1ubuntu1+esm1 | [python3-openssl 17.5.0-1ubuntu1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-openssl-17.5.0-1ubuntu1-esm1.md) | Mar 17, 2026 | | Linux | python3-openssl Ubuntu 20.04 LTS (focal) | 19.0.0-1ubuntu0.1~esm1 | [python3-openssl 19.0.0-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-openssl-19.0.0-1ubuntu0.1-esm1.md) | Mar 17, 2026 | | Linux | python3-openssl Ubuntu 22.04.1 LTS (jammy) | 21.0.0-1ubuntu0.1 | [python3-openssl 21.0.0-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-openssl-21.0.0-1ubuntu0.1.md) | Apr 15, 2026 | | Linux | python3-openssl Ubuntu 24.04.5 LTS (noble) | 23.2.0-1ubuntu0.1 | [python3-openssl 23.2.0-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-python3-openssl-23.2.0-1ubuntu0.1.md) | Apr 15, 2026 | | Linux | python3-openssl Ubuntu 25.10 (questing) | 25.0.0-1ubuntu0.1 | [python3-openssl 25.0.0-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-python3-openssl-25.0.0-1ubuntu0.1.md) | Apr 15, 2026 | | Linux | python3-pyOpenSSL ol 9 | 0:19.0.0-1.0.3.el9 | [ELSA-2026-50324](https://patchblox.com/security/data/fix/linux/elsa-2026-50324.md) | Jun 24, 2026 | | Linux | python3-pyOpenSSL sles 15.7 | 21.0.0-150400.22.1 | [SUSE-SU-2026:3424-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3424-1.md) | Jul 30, 2026 | | Linux | python39-oci-sdk ol 9 | 0:2.187.0-1.0.5.el9 | [ELSA-2026-604898](https://patchblox.com/security/data/fix/linux/elsa-2026-604898.md) | Nov 7, 2026 | | Linux | python39-oci-sdk-docs ol 9 | 0:2.187.0-1.0.5.el9 | [ELSA-2026-604898](https://patchblox.com/security/data/fix/linux/elsa-2026-604898.md) | Nov 7, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.