Buffer Overflow Vulnerability in Cryptography Package by Python Software Foundation
CVE-2026-39892

6.9MEDIUM

Key Information:

Vendor

Pyca

Status
Cryptography
Vendor
CVE Published:
8 April 2026

What is CVE-2026-39892?

A vulnerability exists in the Cryptography package for Python that could potentially allow a buffer overflow if a non-contiguous buffer is passed to specific APIs, such as Hash.update(). This issue affects versions from 45.0.0 up to, but not including, 46.0.7. Developers should upgrade to version 46.0.7 or later to mitigate this vulnerability.

Affected Version(s)

cryptography >= 45.0.0, < 46.0.7

References

https://github.com/pyca/cryptography/security/advisories/...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.