FlawAtlas
Search the atlas
CVE-2026-39892 Critical

CVE-2026-39892

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Exploit probability 0.7%
Published April 8, 2026
Required by Not available
Last source change May 20, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

8 explicit affected versions

PyPI cryptography

15 explicit affected versions

PyPI cryptography

15 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2026-39892

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

View original source
Open Source Vulnerabilities GHSA-p423-j2cm-9vmq

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. `Hash.update()`), this could lead to buffer overflows. For example: ```python h = Hash(SHA256()) b.update(buf[::-1]) ``` would read past the end of the buffer on Python >3.11

View original source
Open Source Vulnerabilities PYSEC-2026-36

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

View original source

05 / REFERENCES

Further evidence