CVE-2023-49083: cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-11-29 · updated 2026-06-17
Weakness: CWE-476

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

Affected products

pyca cryptography: from 3.1 before 41.0.6 — fixed in 41.0.6
Pypi Cryptography: from 3.1 before 41.0.6; 3.1, 3.1.1, 3.2, 3.2.1, 3.3, 3.3.1 (+36) — fixed in 41.0.6

How to fix

Upgrade to a fixed version: pyca cryptography 41.0.6; Pypi Cryptography 41.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-49083 or the next vulnerability affects your stack