Cryptography Package Vulnerability in Python Affects RSA Decryption

CVE-2026-69247

What is CVE-2026-69247?

The cryptography package for Python, specifically versions 44.0.0 through 50.0.0, contains a vulnerability that can lead to the exposure of sensitive information during RSA decryption of encrypted keys. This flaw allows attackers to discern the length of recovered RSA keys based on the varying outcomes from decryption attempts, which provides a foundation for conducting timing attacks. Under certain conditions—such as the use of libraries like OpenSSL, LibreSSL, or BoringSSL lacking implicit rejection—the flaw becomes exploitable. This issue is particularly critical for services automatically decrypting untrusted EnvelopedData, such as S/MIME gateways or mail filters, making it imperative for developers to update to version 50.0.0 or later to mitigate this risk.

References