CVE-2026-39892

CRITICAL

cryptography 45.0.0-46.0.6 APIs - Buffer Overflow

Title source: manual

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

References (2)

Core 2

Core References

X_Refsource_Confirm x_refsource_confirm

https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq

Mailing List

http://www.openwall.com/lists/oss-security/2026/04/08/12

Scores

CVSS v3 9.8

EPSS 0.0053

EPSS Percentile 40.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-119

Status published

Products (3)

cryptography.io/cryptography 45.0.0 - 46.0.7

pyca/cryptography >= 45.0.0, < 46.0.7

pypi/cryptography 45.0.0 - 46.0.7PyPI

Published Apr 08, 2026

Tracked Since Apr 09, 2026