CVE-2026-39892

CRITICAL

9.8

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie4/8/2026

Derniere modification4/15/2026

Sourcenvd

Observations honeypot0

Produits affectes

cryptography.io:cryptography

Faiblesses (CWE)

CWE-119

References

https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq(security-advisories@github.com)

http://www.openwall.com/lists/oss-security/2026/04/08/12(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.