The flaw lies in the pyOpenSSL library's handling of DTLS cookie generation callbacks. When a callback returns a cookie longer than the expected 256 bytes, the library passes that oversized value to an OpenSSL buffer that cannot accommodate it, causing a buffer overflow. This overflow can corrupt adjacent memory, potentially leading to arbitrary code execution or other severe compromises. The weakness corresponds to the classic stack or heap overrun identified as CWE-120.

The affected product is pyOpenSSL, a Python wrapper maintained by the PyCA project, specifically versions 22.0.0 through 25.x. Any environment that imports pyOpenSSL and configures a DTLS cookie callback may be affected. Starting with version 26.0.0, the library rejects cookie values that exceed the 256‑byte limit, eliminating the risk.

The CVSS score of 7.2 indicates a high severity rating, but the EPSS score of less than 1 % suggests a low expected exploitation frequency at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, inferred from the description of a DTLS handshake that triggers the cookie callback. Exploitation would also require control over the callback implementation or the ability to supply malicious cookie data, which is inferred as a prerequisite.