{"id":"CVE-2026-39892","title":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers","summary":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this …","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-119","CWE-131"],"vendor":"cryptography.io","product":"cryptography","affected":["cryptography >= 45.0.0, < 46.0.7"],"patched":["cryptography 46.0.7"],"published":"2026-04-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:20:00.007","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39892","references":[{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq","label":"security-advisories@github.com"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/08/12","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20338","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21017","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22465","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22629","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22840","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23361","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24483","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24761","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24762","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24853","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30089","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43651","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43670","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43851","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43853","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43854","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43855","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46956","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7295","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-39892","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456735","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39892.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39892"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39892"},{"url":"https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5"},{"url":"https://github.com/pyca/cryptography"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-36.yaml"}],"tags":["nvd","cve.org","csaf","vex","red-hat","osv","pip","score-dispute"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-04-09T19:41:57.662246Z"},"scores":{"nvd":9.8,"cna":6.9,"vendor":7.3},"epss":0.00652,"epssPercentile":0.51033,"ingestedAt":"2026-07-01T15:50:58.769Z","aliases":["GHSA-p423-j2cm-9vmq","PYSEC-2026-36"],"ecosystem":"pip","slug":"CVE-2026-39892","body":"## Overview\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.\n\n## Affected\n\n- `cryptography >= 45.0.0, < 46.0.7`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `cryptography 46.0.7`\n\n## Vendor advisories\n\n- **RHSA-2026:24761** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24761)\n- **RHSA-2026:24762** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24762)\n- **RHSA-2026:30089** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30089)\n- **RHSA-2026:30088** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30088)\n- **RHSA-2026:24866** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24866)\n- **RHSA-2026:20338** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20338)\n- **RHSA-2026:43855** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43855)\n- **RHSA-2026:43854** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43854)\n- **RHSA-2026:43851** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43851)\n- **RHSA-2026:43670** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43670)\n- **RHSA-2026:43853** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43853)\n- **Red Hat VEX** · Important · affected: Lightspeed Core, Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat Discovery 2, … · no fix planned: Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Quay 3, Lightspeed Core, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39892.json)\n\n## Package advisory (CVE-2026-39892)\n\nAffected packages:\n\n- `cryptography >= 45.0.0, < 46.0.7`\n\nPatched in:\n\n- `cryptography 46.0.7`\n\nSource: https://osv.dev/vulnerability/GHSA-p423-j2cm-9vmq","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}