Vulnerability Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cryptography.Io | Cryptography | >= 45.0.0, < 46.0.7 |
Related Weaknesses (CWE)
References
- https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmqVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/08/12Mailing ListRelease NotesThird Party Advisory
FAQ
What is CVE-2026-39892?
CVE-2026-39892 is a vulnerability with a CVSS score of 9.8 (CRITICAL). cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Pytho...
How severe is CVE-2026-39892?
CVE-2026-39892 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-39892?
Check the references section above for vendor advisories and patch information. Affected products include: Cryptography.Io Cryptography.