Discovery API Icon
Discovery API
Security Advisory Icon
Security Advisory
Package Manager Icon
Package Manager
Alpaquita LinuxStreamSecurity Advisory
Search Cve

CVE-2026-39892

Published: April 10, 2026Last modified: April 20, 2026

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Severity score breakdown

ParameterValue
Base score9.8
Attack VectorNETWORK
Attack complexityLOW
Privileges requiredNONE
User interactionNONE
ScopeUNCHANGED
ConfidentialityHIGH
Integrity impactHIGH
Availability impactHIGH
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Notes

Introduced with: https://github.com/pyca/cryptography/commit/6801b2eb6554abfcb8e4bb48e97a01cdb6f69798 (45.0.0)

Status

ProductReleasePackageStatus
Alpaquita Linux23 LTSpy3-cryptographyNot affected (38.0.3-r1)
25 LTSpy3-cryptographyNot affected (44.0.3-r0)
Streampy3-cryptographyFixed (46.0.7-r0)

References

ON THIS PAGE