CVE-2026-39892

CRITICAL

cryptography 45.0.0-46.0.6 APIs - Buffer Overflow

Title source: manual
STIX 2.1

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

References (30)

Core 30
Core References

Scores

CVSS v3 9.8
EPSS 0.0065
EPSS Percentile 47.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-119 CWE-131
Status published
Products (3)
cryptography.io/cryptography 45.0.0 - 46.0.7
pyca/cryptography >= 45.0.0, < 46.0.7
pypi/cryptography 45.0.0 - 46.0.7PyPI
Published Apr 08, 2026
Tracked Since Apr 09, 2026