CVE-2026-39892
Published: April 10, 2026Last modified: April 20, 2026
Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | HIGH |
| Integrity impact | HIGH |
| Availability impact | HIGH |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Notes
Introduced with: https://github.com/pyca/cryptography/commit/6801b2eb6554abfcb8e4bb48e97a01cdb6f69798 (45.0.0)
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | py3-cryptography | Not affected (38.0.3-r1) |
| 25 LTS | py3-cryptography | Not affected (44.0.3-r0) | |
| Stream | py3-cryptography | Fixed (46.0.7-r0) |