PyCryptodome integer overflow vulnerability

HIGH 7.5CVE-2018-15560 · GHSA-hgg3-g7gr-66r7 · PYSEC-2018-21 · Published 20/08/2018 · updated 17/06/2026

In short

CVE-2018-15560 is a HIGH (CVSS 7.5) vulnerability affecting pycryptodome, pycryptodome (pycryptodome).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.0% of all vulnerabilities.
Fix: update to 3.6.6 or later.

Package	Affected versions	Patched versions
pycryptodome PyPI	`< 3.6.6`	`3.6.6`
pycryptodome pycryptodome	`< 3.6.6`	`3.6.6`

Description

PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-15560 · ADVISORY
Legrandin/pycryptodome · WEB
Legrandin/pycryptodome · PACKAGE
GitHub Advisory GHSA-hgg3-g7gr-66r7 · ADVISORY
pypa/advisory-database · WEB
whitehatck01.blogspot.com/2018/08/integer-overflow-vulnerability-in.html · WEB

More vulnerabilities in pycryptodome

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free