p PatchFirst

CVE-2026-39892

CVE-2026-39892 · cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

CVSS 6.9 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • cryptography

    Versions
    • >= 45.0.0, < 46.0.7: Affected

    No fix published

  • python-cryptography Debian:14

    Versions
    • 43.0.0-3
    • 44.0.2-1
    • 44.0.2-2
    • 45.0.6-1
    • 45.0.6-1~exp1
    • 45.0.7-1
    • 46.0.1-1
    • 46.0.1-1~exp1
    • 46.0.5-1
    • 46.0.5-2
    • 46.0.6-1
    Affected ranges
    • ECOSYSTEM: < 46.0.7-1

    Update to 46.0.7-1

  • cryptography PyPI

    Versions
    • 45.0.0
    • 45.0.1
    • 45.0.2
    • 45.0.3
    • 45.0.4
    • 45.0.5
    • 45.0.6
    • 45.0.7
    • 46.0.0
    • 46.0.1
    • 46.0.2
    • 46.0.3
    • 46.0.4
    • 46.0.5
    • 46.0.6
    Affected ranges
    • ECOSYSTEM: ≥ 45.0.0, < 46.0.7

    Update to 46.0.7

Original sources

Check your server →