CVE-2026-39892

CRITICAL

9.8

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published4/8/2026

Last Modified4/15/2026

Sourcenvd

Honeypot Sightings0

Affected Products

cryptography.io:cryptography

Weaknesses (CWE)

CWE-119

References

https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq(security-advisories@github.com)

http://www.openwall.com/lists/oss-security/2026/04/08/12(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.