PT-2026-31459 · Pypi · Cryptography

Published 2026-04-08 · Updated 2026-05-11 · CVE-2026-39892

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cryptography versions 45.0.0 through 46.0.6

Description The cryptography package, designed for cryptographic primitives in Python, contains a flaw where non-contiguous buffers passed to APIs accepting Python buffers (e.g., Hash.update()) can lead to buffer overflows. This issue affects Python versions greater than 3.11.

Recommendations Update to cryptography version 46.0.7 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2026-39892

GHSA-P423-J2CM-9VMQ

OPENSUSE-SU-2026:10535-1

PYSEC-2026-36

RHSA-2026:7295

Affected Products

Cryptography

References · 19

• https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-39892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39892 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-39892 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-39892 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-39892 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p423-j2cm-9vmq · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-36 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10535-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-39892 · Vendor Advisory
• https://github.com/pyca/cryptography · Note
• https://twitter.com/oss_security/status/2042415936422994249 · Twitter Post
• https://suse.com/security/cve/CVE-2026-39892 · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-39892 · Note
• https://twitter.com/dailycve/status/2042250380180914499 · Twitter Post