CVE-2026-39892 Details
Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
A buffer overflow vulnerability has been identified in the Python cryptography package, specifically in versions 45.0.0 prior to 46.0.7. The issue arises when non-contiguous buffers are passed to APIs that accept Python buffers, such as Hash.update(). This can lead to reading past the end of the buffer, creating a potential security risk.
Users can upgrade to cryptography version 46.0.7 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-131 | Incorrect Calculation of Buffer Size | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| cryptography.io cryptography | >= 45.0.0, < 46.0.7 |
CPE
Remediation
| |
Change History
22 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | redhat-SADP |
| Sep 10, 2026 | CVE Modified | CVE |
| Sep 10, 2026 | CVE Modified | [email protected] |
| Aug 17, 2026 | CVE Modified | redhat-SADP |
| Aug 12, 2026 | CVE Modified | redhat-SADP |
| Jul 30, 2026 | CVE Modified | redhat-SADP |
| Jul 29, 2026 | CVE Modified | redhat-SADP |
| Jul 28, 2026 | CVE Modified | redhat-SADP |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 17, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 1, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | Initial Analysis | [email protected] |
| Apr 8, 2026 | CVE Modified | CVE |
| Apr 8, 2026 | New CVE Received | [email protected] |