PT-2026-31459 · Pypi · Cryptography

Bzimport · CVE-2026-39892 · Published 2026-04-08 · Updated 2026-07-10

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cryptography versions 45.0.0 through 46.0.6

Description The cryptography package, designed for cryptographic primitives in Python, contains a flaw where non-contiguous buffers passed to APIs accepting Python buffers (e.g., Hash.update()) can lead to buffer overflows. This issue affects Python versions greater than 3.11.

Recommendations Update to cryptography version 46.0.7 or later.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-131

CWE-119

Related Identifiers

CLEANSTART-2026-CQ05396

CVE-2026-39892

ECHO-0A60-183D-A61B

GHSA-P423-J2CM-9VMQ

OPENSUSE-SU-2026:10535-1

PYSEC-2026-36

RHSA-2026:24761

RHSA-2026:24762

RHSA-2026:7295

Affected Products

Cryptography

References · 126

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39892.json · Exploit
• https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:37275 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41066 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48522 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48525 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41205 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48526 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31958 · Security Note
• https://osv.dev/vulnerability/GHSA-p423-j2cm-9vmq · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:22840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33936 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44681 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34518 · Security Note