CVE-2026-39892

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Score
CVSS 3.1 9.8 Critical
Status
Modified - security-advisories@github.com
Published
2026-04-08
Last modified
2026-09-10
Weaknesses
CWE-119, CWE-131

Affected products

References

 
 
© AVABIS GmbH privacypolicy about