Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

CRITICO 9.8CVE-2026-39892 · GHSA-p423-j2cm-9vmq · PYSEC-2026-36 · Published 08/04/2026 · updated 10/09/2026

In breve

CVE-2026-39892 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda cryptography, cryptography (cryptography.io).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.65%, superiore al 51.2% delle vulnerabilità.
Correzione: aggiornare a 46.0.7 o successiva.

Package	Affected versions	Patched versions
cryptography PyPI	`≥ 45.0.0, < 46.0.7`	`46.0.7`
cryptography cryptography.io	`≥ 45.0.0, < 46.0.7`	`46.0.7`

Description

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. For example:

h = Hash(SHA256())
b.update(buf[::-1])

would read past the end of the buffer on Python >3.11

NVD description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

References

Altre vulnerabilità di cryptography

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cryptography

PyPI

≥ 45.0.0, < 46.0.7

46.0.7

cryptography

cryptography.io

≥ 45.0.0, < 46.0.7

46.0.7

Description

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. For example:

h = Hash(SHA256())
b.update(buf[::-1])

would read past the end of the buffer on Python >3.11

NVD description

Altre vulnerabilità di cryptography

Vedi tutto →