Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

CRITICAL 9.8CVE-2026-39892 · GHSA-p423-j2cm-9vmq · PYSEC-2026-36 · Published 08/04/2026 · updated 10/09/2026

Package	Affected versions	Patched versions
cryptography PyPI	`≥ 45.0.0, < 46.0.7`	`46.0.7`
cryptography cryptography.io	`≥ 45.0.0, < 46.0.7`	`46.0.7`

Description

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. For example:

h = Hash(SHA256())
b.update(buf[::-1])

would read past the end of the buffer on Python >3.11

NVD description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free