Technical impact
pyOpenSSL provides a wrapper for OpenSSL. Before version 26.0.0, a provider‑supplied callback to set_tlsext_servername_callback that raised an exception caused the library to accept the TLS connection regardless of the error. This flaw, classified as improper error handling (CWE‑636), allows an attacker to bypass logic that relies on the callback for security considerations, such as rejecting connections that do not match expected server names or protocols.
Affected Systems
The vulnerability impacts the pyca:pyopenssl product. Versions from 0.14.0 through 25.99.999 are affected. Starting with version 26.0.0, the library now rejects connections when the callback raises an unhandled exception, fixing the issue.
Risk and Exploitability
The CVSS score of 1.7 indicates a low severity, and the EPSS score of less than 1 % suggests a very low chance of exploitation. The flaw is not present in the CISA KEV catalog. In practice, exploitation requires a client that triggers an exception in a custom callback, and only systems that rely on that callback for security decisions are truly at risk. Monitoring for unhandled exceptions and applying the available patch therefore mitigates the risk.
Github GHSA
Ubuntu USN