CVE-2026-53720 Details
Description
pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will write past the end of the buffer and possibly corrupt the heap. This issue has been patched in version 4.0.2.8.
A heap buffer overflow vulnerability has been identified in the pymonocypher library, specifically in the Argon2i_32 function. This issue arises because the function does not validate the nb_blocks parameter, allowing for potential memory corruption if a caller provides a buffer that is too small. The vulnerability is present in versions prior to 4.0.2.8.
Users can upgrade to pymonocypher version 4.0.2.8 or later, which includes the necessary parameter validation to prevent the buffer overflow. The updated version is available on the GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jetperch/pymonocypher/commit/90ff5b13b13b5673c372e188f482d8c172e6ab86 | [email protected] | Source CodeVendor |
| https://github.com/jetperch/pymonocypher/releases/tag/v4.0.2.8 | [email protected] | Release NotesVendor |
| https://github.com/jetperch/pymonocypher/security/advisories/GHSA-8f95-v3jq-cj86 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jetperch pymonocypher | 4.0.2.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | New CVE Received | [email protected] |
| Sep 3, 2026 | CVE Modified | CISA-ADP |