{"kind": "product", "path": "vulns/pypi/cryptography", "name": "cryptography", "product": "cryptography", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-69249", "noindex": false, "published": "2026-08-03T21:26:45.826Z", "modified": "2026-09-04T21:20:32.666Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00252, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-69249", "title": "python-cryptography: Duplicate self-signed intermediates can cause exponential path-building", "description": "python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource ex", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww", "https://github.com/pyca/cryptography/pull/14960", "https://github.com/pyca/cryptography/commit/3763aa79b"], "fixes": ["49.0.0"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}, {"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-69248", "noindex": false, "published": "2026-08-03T21:21:43.710Z", "modified": "2026-09-02T13:26:35.057Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00244, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-69248", "title": "python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid ce", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c", "https://github.com/pyca/cryptography/pull/14888", "https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2"], "fixes": ["49.0.0"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}, {"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-69247", "noindex": false, "published": "2026-08-03T21:16:32.047Z", "modified": "2026-08-04T14:09:24.615Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00274, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-69247", "title": "cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an ", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5", "https://github.com/pyca/cryptography/pull/15369", "https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f"], "fixes": ["50.0.0"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "GHSA-537c-gmf6-5ccf", "noindex": false, "published": "2026-06-15T20:12:27Z", "modified": "2026-09-10T03:50:48.298936410Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-537c-gmf6-5ccf", "title": "Vulnerable OpenSSL included in cryptography wheels", "description": "pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-537c-gmf6-5ccf", "https://github.com/pyca/cryptography", "https://openssl-library.org/news/secadv/20260609.txt"], "fixes": ["48.0.1"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-39892", "noindex": false, "published": "2026-04-08T20:49:41.967Z", "modified": "2026-09-10T12:04:47.954Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00757, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-39892", "title": "cryptography has a buffer overflow if non-contiguous buffers were passed to APIs", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq", "http://www.openwall.com/lists/oss-security/2026/04/08/12", "https://access.redhat.com/security/cve/CVE-2026-39892"], "fixes": ["46.0.7"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-34073", "noindex": false, "published": "2026-03-31T02:04:36.275Z", "modified": "2026-10-14T16:07:55.097Z", "cvss": 1.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U", "severity": "low", "epss": 0.00184, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-34073", "title": "cryptography has incomplete DNS name constraint enforcement on peer names", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the \"peer name\" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43", "https://www.kb.cert.org/vuls/id/948176", "https://nvd.nist.gov/vuln/detail/CVE-2026-34073"], "fixes": ["46.0.6"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-26007", "noindex": false, "published": "2026-02-10T21:42:56.471Z", "modified": "2026-09-16T12:04:21.492Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00389, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-26007", "title": "cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the vi", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2", "https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c", "http://www.openwall.com/lists/oss-security/2026/02/10/4"], "fixes": ["46.0.5"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-12797", "noindex": false, "published": "2025-02-11T15:59:36.719Z", "modified": "2025-02-18T14:01:55.140Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.02531, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-12797", "title": "RFC7250 handshakes with unauthenticated servers don't abort as expected", "description": "Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a\nserver may fail to notice that the server was not authenticated, because\nhandshakes don't abort as expected when the SSL_VERIFY_PEER verification mode\nis set.\n\nImpact summary: TLS and DTLS connections using raw public keys may be\nvulnerable to man-in-middle attacks when server authentication failure is not\ndetected by clients.\n\nRPKs are disabled by default in both TLS clients and TLS servers.  The issue\nonly arises when TLS clients explicitly enable RPK use by the server, and the\nserver, likewise, enables sending of an RPK instead of an X.509 certificate\nchain.  The", "references": ["https://openssl-library.org/news/secadv/20250211.txt", "https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9", "https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699"], "fixes": ["44.0.1"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "GHSA-h4gh-qq45-vh27", "noindex": false, "published": "2024-09-03T21:59:48Z", "modified": "2026-09-10T03:50:18.241644273Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-h4gh-qq45-vh27", "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "description": "pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-43.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20240903.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.\n", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-h4gh-qq45-vh27", "https://github.com/pyca/cryptography", "https://openssl-library.org/news/secadv/20240903.txt"], "fixes": ["43.0.1"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-26130", "noindex": false, "published": "2024-02-21T16:28:18.632Z", "modified": "2024-08-14T20:01:52.628Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00831, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-26130", "title": "cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4", "https://github.com/pyca/cryptography/pull/10423", "https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55"], "fixes": ["42.0.4"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}, {"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-50782", "noindex": false, "published": "2024-02-05T20:45:49.705Z", "modified": "2026-03-24T11:28:21.353Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.01118, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-50782", "title": "Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659", "description": "A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.", "references": ["https://access.redhat.com/security/cve/CVE-2023-50782", "https://bugzilla.redhat.com/show_bug.cgi?id=2254432", "https://www.couchbase.com/alerts/"], "fixes": ["42.0.0"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-0727", "noindex": false, "published": "2024-01-26T08:57:19.579Z", "modified": "2026-10-15T00:21:17.299Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.03187, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-0727", "title": "PKCS12 Decoding crashes", "description": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application wi", "references": ["https://www.openssl.org/news/secadv/20240125.txt", "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a", "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c"], "fixes": ["42.0.2"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-49083", "noindex": false, "published": "2023-11-29T18:50:24.263Z", "modified": "2025-12-18T15:32:14.214Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00985, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-49083", "title": "cryptography vulnerable to NULL-dereference when loading PKCS7 certificates", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97", "https://github.com/pyca/cryptography/pull/9926", "https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a"], "fixes": ["41.0.6"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}, {"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "GHSA-v8gr-m533-ghj9", "noindex": false, "published": "2023-09-21T17:07:01Z", "modified": "2026-09-10T03:50:03.291941916Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-v8gr-m533-ghj9", "title": "Vulnerable OpenSSL included in cryptography wheels", "description": "pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230908.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-v8gr-m533-ghj9", "https://github.com/pyca/cryptography/commit/fc11bce6930e591ce26a2317b31b9ce2b3e25512", "https://github.com/pyca/cryptography"], "fixes": ["41.0.4"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "GHSA-jm77-qphf-c4w8", "noindex": false, "published": "2023-08-01T22:34:41Z", "modified": "2026-09-10T03:50:02.832467975Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-jm77-qphf-c4w8", "title": "pyca/cryptography's wheels include vulnerable OpenSSL", "description": "pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt, https://www.openssl.org/news/secadv/20230719.txt, and https://www.openssl.org/news/secadv/20230714.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography version", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-jm77-qphf-c4w8", "https://github.com/pyca/cryptography/commit/b22271cf3c3dd8dc8978f8f4b00b5c7060b6538d", "https://github.com/pyca/cryptography/commit/bfa4d95f0f356f2d535efd5c775e0fb3efe90ef2"], "fixes": ["41.0.3"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-38325", "noindex": false, "published": "2023-07-14T00:00:00.000Z", "modified": "2024-10-30T16:00:29.757Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.00732, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-38325", "title": "CVE-2023-38325", "description": "The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.", "references": ["https://github.com/pyca/cryptography/issues/9207", "https://github.com/pyca/cryptography/pull/9208", "https://pypi.org/project/cryptography/#history"], "fixes": ["41.0.2"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "GHSA-5cpq-8wj7-hf2v", "noindex": false, "published": "2023-06-02T17:13:10Z", "modified": "2026-09-10T03:50:02.133725445Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-5cpq-8wj7-hf2v", "title": "Vulnerable OpenSSL included in cryptography wheels", "description": "pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.5-40.0.2 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://www.openssl.org/news/secadv/20230530.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-5cpq-8wj7-hf2v", "https://github.com/pyca/cryptography/commit/8708245ccdeaff21d65eea68a4f8d2a7c5949a22", "https://cryptography.io/en/latest/changelog/#v41-0-0"], "fixes": ["41.0.0"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-0286", "noindex": false, "published": "2023-02-08T19:01:50.514Z", "modified": "2026-10-14T19:23:44.227Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "severity": "high", "epss": 0.71239, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-0286", "title": "X.400 address type confusion in X.509 GeneralName", "description": "There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most", "references": ["https://www.openssl.org/news/secadv/20230207.txt", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658", "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9"], "fixes": ["39.0.1"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-23931", "noindex": false, "published": "2023-02-07T20:54:03.628Z", "modified": "2025-11-03T21:47:19.856Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.01301, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-23931", "title": "Cipher.update_into can corrupt memory in pyca cryptography", "description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r", "https://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3", "https://security.netapp.com/advisory/ntap-20230324-0007/"], "fixes": ["39.0.1"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}, {"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}, {"id": "GHSA-39hc-v87j-747x", "noindex": false, "published": "2022-11-02T18:11:56Z", "modified": "2024-12-03T06:08:44.549863Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-39hc-v87j-747x", "title": "Vulnerable OpenSSL included in cryptography wheels", "description": "pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-38.0.3 are vulnerable to a number of security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221101.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.", "references": ["https://github.com/pyca/cryptography/security/advisories/GHSA-39hc-v87j-747x", "https://github.com/pyca/cryptography/commit/382e759bcded5773330eeed748c86b213ec618c5", "https://github.com/pyca/cryptography/commit/cf2ada625d1188d6cd46396f301b98095da577f7"], "fixes": ["38.0.3"], "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}]}], "total": 24, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "cryptography", "path": "vulns/pypi/cryptography", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-15T00:21:17.299Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}