CVE-2026-39892

CRITICAL

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

Title source: cna
STIX 2.1

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

References (2)

Scores

CVSS v3 9.8
EPSS 0.0002
EPSS Percentile 6.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-119
Status published
Products (3)
cryptography.io/cryptography 45.0.0 - 46.0.7
pyca/cryptography >= 45.0.0, < 46.0.7
pypi/cryptography 45.0.0 - 46.0.7PyPI
Published Apr 08, 2026
Tracked Since Apr 09, 2026