PT-2026-56852 · Pypi · Pymonocypher

Publicado 2026-07-09 · Atualizado 2026-07-09 · CVE-2026-53720

OSV

CVSS v4.0

5.1

Média

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Impact

The argon2i 32 implementation does not check the nb blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i 32 will write past the end of the buffer and possibly corrupt the heap.

Patches

Fixed in 4.0.2.8, which now verifies that nb blocks is large enough. See 90ff5b1.

Workarounds

Provide a correctly sized nb blocks buffer.

pymonocypher thanks Haris (hextheshadow) for the vulnerability report, details, and recommended fix.

Correção

Heap Based Buffer Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-1284

CWE-122

CWE-787

Identificadores relacionados

CVE-2026-53720

GHSA-8F95-V3JQ-CJ86

Produtos afetados

Pymonocypher

Referências · 4

• https://github.com/jetperch/pymonocypher/commit/90ff5b13b13b5673c372e188f482d8c172e6ab86 · Nota
• https://github.com/jetperch/pymonocypher/security/advisories/GHSA-8f95-v3jq-cj86 · Nota
• https://osv.dev/vulnerability/GHSA-8f95-v3jq-cj86 · Aviso do Fabricante
• https://github.com/jetperch/pymonocypher · Nota