--- id: CVE-2026-39892 title: >- cryptography is a package designed to expose cryptographic primitives and recipes to Python developers summary: >- cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this … severity: critical cvss: 9.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-119 - CWE-131 vendor: cryptography.io product: cryptography affected: - 'cryptography >= 45.0.0, < 46.0.7' patched: - cryptography 46.0.7 published: '2026-04-08' updated: '2026-09-10' sourceUpdated: '2026-09-10T13:20:00.007' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-39892' references: - url: >- https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq label: security-advisories@github.com - url: 'http://www.openwall.com/lists/oss-security/2026/04/08/12' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2026:19375' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20338' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:21017' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22465' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22629' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22840' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23361' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24483' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24761' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24762' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24853' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24866' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24977' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:30088' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:30089' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:37275' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42644' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:43651' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:43670' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:43851' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:43853' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:43854' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:43855' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:46956' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7295' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-39892' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2456735' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39892.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-39892' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-39892' - url: >- https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5 - url: 'https://github.com/pyca/cryptography' - url: >- https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-36.yaml tags: - nvd - cve.org - csaf - vex - red-hat - osv - pip - score-dispute ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-04-09T19:41:57.662246Z' scores: nvd: 9.8 cna: 6.9 vendor: 7.3 epss: 0.00652 epssPercentile: 0.51033 ingestedAt: '2026-07-01T15:50:58.769Z' aliases: - GHSA-p423-j2cm-9vmq - PYSEC-2026-36 ecosystem: pip --- ## Overview cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7. ## Affected - `cryptography >= 45.0.0, < 46.0.7` ## Remediation Upgrade past the affected range: - `cryptography 46.0.7` ## Vendor advisories - **RHSA-2026:24761** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24761) - **RHSA-2026:24762** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24762) - **RHSA-2026:30089** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30089) - **RHSA-2026:30088** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30088) - **RHSA-2026:24866** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24866) - **RHSA-2026:20338** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20338) - **RHSA-2026:43855** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43855) - **RHSA-2026:43854** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43854) - **RHSA-2026:43851** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43851) - **RHSA-2026:43670** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43670) - **RHSA-2026:43853** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43853) - **Red Hat VEX** · Important · affected: Lightspeed Core, Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat Discovery 2, … · no fix planned: Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Quay 3, Lightspeed Core, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39892.json) ## Package advisory (CVE-2026-39892) Affected packages: - `cryptography >= 45.0.0, < 46.0.7` Patched in: - `cryptography 46.0.7` Source: https://osv.dev/vulnerability/GHSA-p423-j2cm-9vmq