What’s Vulnerable › Vulnerabilities

CVE-2026-39892: cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Affected products

How to fix

Upgrade to a fixed version: pyca cryptography 46.0.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-39892 or the next vulnerability affects your stack