What’s Vulnerable › Vulnerabilities

CVE-2024-26130: cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-21 · updated 2026-06-17
• Weakness: CWE-476

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.

Affected products

• pyca cryptography: from 38.0.0 before 42.0.4 — fixed in 42.0.4

How to fix

Upgrade to a fixed version: pyca cryptography 42.0.4. Check the vendor advisory for mitigations.

References

• https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55
• https://github.com/pyca/cryptography/pull/10423
• https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4
• https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55
• https://github.com/pyca/cryptography/pull/10423
• https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4

Get alerted when CVE-2024-26130 or the next vulnerability affects your stack